Personal data protection policy
This document describes the policy of "Findly" OOD, EIK: 207367667, with its registered office and management address in the city of Varna, p.k. 9000, "Primorski" district, g.k. "Chaika", bl. 23, entrance A, fl. 1, ground floor for the protection of Personal Data, how your personal information that you provide to us in connection with the use of our services is used, stored and protected. This policy is an integral part of the General Terms of Use of the site.
If you have any questions or comments regarding this Policy, you can find contact information on the Contact page or write to us directly.
Please read this Policy carefully before using our services. It is written in as specific and clear a way as possible to make it easy for you to read and understand.
• By registering on our platform, you agree to the Policy and expressly confirm that you accept it.
• If you do not wish us to process your Personal Data in the manner described in the Policy, please do not provide it to us. The provision of Personal Data is voluntary, with a view to using the services of our Platform or accessing them. Any refusal by you to provide the necessary Personal Data to use the services on our platform would mean a refusal to use or access the relevant services.
• In certain cases, your express consent to the processing of Personal Data may not be necessary if another legal basis is available, for example: compliance with the Administrator's legal obligations; necessity for the performance of a contract, etc
• The control authority regarding the protection of Personal Data is: Commission for the Protection of Personal Data.
THE COMPANY or the ADMINISTRATOR: "Findly" OOD, EIC: 207367667, with headquarters and management address in the city of Varna, p.k. 9000, "Primorski" district, g.k. "Chaika", bl. 23, entrance A, fl. 1,.
PERSONAL DATA: Any information relating to a natural person who is identified or can be identified directly or indirectly by an identification number or by one or more specific characteristics.
PROCESSING OF PERSONAL DATA: Any action or set of actions that may be performed in relation to Personal Data by automatic or other means, such as collection, recording, organization, storage, adaptation or modification, recovery, consultation, use, disclosure or transmission , distribute, update or combine, block, delete or destroy the data
PERSONAL DATA SUBJECT: Any individual whose Personal Data is processed.
THE PLATFORM: The term refers to a virtual platform owned by the Company, which includes the following sites, served by a common technical infrastructure and program code: • www.findly.bg - an internet platform for reservations and sales of hotel services through the mediation of the administrator, from which the Company rents out virtual space of Merchants-sellers, to publish offers for the remote sale of their services/goods to end Users-buyers;
• A set of other co-branded partner sites served by the Company and providing services identical/similar to www.findly.bg (but with limited functionality).
Additional concepts are explained in the General terms of use of the site.
III. PERSONAL DATA
Types of Subjects of personal data, Categories of processed data, Purposes of processing, Storage period
According to the way individuals use our Platform and the services it provides, they fall into several divisions listed below. Depending on them, the data of the Subjects is processed in separate Personal Data Registers, and for each of them the processing may include different categories of data, purposes and grounds, storage periods, protection measures and others.
The same person may fall into more than one of the listed subdivisions at the same time. For example, each Registered User is also a Visitor; each Buyer User is also a Registered User and Visitor.
Visitors
A visitor is any person who loads a page that is part of the Platform in their web browser, or visits its various sections and pages (regardless of whether by directly entering the email address in the browser or by referring from another Internet site or resource).
Categories of data that can be processed: Online identifiers stored in local cookies on the visitor's device/browser; Location data provided by the visitor, or their device, with the permission of the visitor; Country/city data based on the IP address of the user's device, an invariable part of the information received from each website; Information about actions performed by the entity on the Platform; Preferences of the subject regarding specific aspects and settings of the platform's functionalities; Information about the type of browser/device used.
Purposes of processing: Provision of basic and auxiliary functions necessary for the correct and full functioning of the Platform; Counting visits to the Platform; Provision of necessary conditions for implementation of services on marketing platforms.
Storage period: Until the expiration of the validity of each "cookie" (up to 1 year from the moment of its recording), carrier of the relevant information, or until it is deleted by the subject in whose device/browser it is stored.
Legal basis for processing: Consent to the Policy.
E-mail subscribers
An e-mail subscriber is any Visitor who has subscribed to the Platform's automatic electronic e-mail newsletter, to receive e-mail letters containing various units of information from the Platform, commercial offers and others. The electronic e-mail newsletter is sent directly by the Administrator, without the use of external intermediary services.
Categories of data that can be processed: Names, E-mail address, Location data, an invariable part of the provision of the service, Preferences of the subscriber regarding the subject of his subscription (interest in cities and locations, categories, etc.; days of receipt of letters and other settings), Information about the browser/device used.
Purposes of processing: Providing the possibility and service of electronic subscriptions (e-mail newsletters), for which visitors sign up (subscribe) - to receive by e-mail various units of information from the Platform, commercial offers and others.
Storage period: Up to 6 months after termination of the subscription by the subscriber or by the Administrator.
Legal basis for processing: Consent to be included in a list of recipients (e-mail newsletter subscription).
Purposes of processing: Provision of basic and auxiliary functions necessary for the correct and full functioning of the Platform; Counting visits to the Platform; Provision of necessary conditions for implementation of services on marketing platforms.
Storage period: Until the expiration of the validity of each "cookie" (up to 1 year from the moment of its recording), carrier of the relevant information, or until it is deleted by the subject in whose device/browser it is stored.
Legal basis for processing: Consent to the Policy.
E-mail subscribersRegistered users
A registered user is any Visitor who has registered on the Platform by entering an e-mail address (and/or username) and password, which action creates a so-called profile or account.
Categories of data that can be processed: Basic mandatory data: Names, E-mail addresses, IP addresses; Optional data entered by the user: Residence, Phone number, Gender, Age, Photo/Avatar, Facebook profile, Google profile; Other data: Information about actions performed by the subject on the Platform, Relationships with other users (online friendships and others), Information about the browser/device used.
Purposes of the processing: Providing the possibility and support for the user to register his account, enabling the use of services on the Platform, such as: concluding distance contracts for making purchases, maintaining a user profile, interacting with other users, etc.
Storage period: 2 years after termination of registration by the user or by the Administrator, if purchases or requests have been made. If there are none – after closing the account, which in this case is also considered a withdrawal of consent.
Legal basis for processing: Agreement with the General Terms and Conditions when registering an account.
Users-buyers
User-buyer is any Visitor and/or Registered user who, through the technical means of the Platform, executes (or requests the execution of) the conclusion of a Purchase and Sale Agreement with a Merchant-seller, with the aim of remotely purchasing a service/goods offered by the latter on the Platform (or similar action).
Categories of data that can be processed: Names, Address, Telephone number, E-mail address, IP addresses, Information on purchases made, Information on actions performed by the subject on the Platform.
Purposes of the processing: Ensuring the possibility of making purchases through the Platform, by concluding distance contracts with Merchants-sellers; Provision to the relevant Merchants-sellers of information about such purchases and about the buyers, necessary for the execution of the concluded contracts and delivery of the relevant purchased services.
Storage period: 10 years after the last purchase made by the user-buyer.
An e-mail subscriber is any Visitor who has subscribed to the Platform's automatic electronic e-mail newsletter, to receive e-mail letters containing various units of information from the Platform, commercial offers and others. The electronic e-mail newsletter is sent directly by the Administrator, without the use of external intermediary services.
Categories of data that can be processed: Names, E-mail address, Location data, an invariable part of the provision of the service, Preferences of the subscriber regarding the subject of his subscription (interest in cities and locations, categories, etc.; days of receipt of letters and other settings), Information about the browser/device used.
Purposes of processing: Providing the possibility and service of electronic subscriptions (e-mail newsletters), for which visitors sign up (subscribe) - to receive by e-mail various units of information from the Platform, commercial offers and others.
Storage period: Up to 6 months after termination of the subscription by the subscriber or by the Administrator.
Legal basis for processing: Consent to be included in a list of recipients (e-mail newsletter subscription).
Legal basis for processing: Fulfillment of a contract with the relevant merchant-seller concluded through the Platform.
Merchants-sellers
Merchant-seller is any person offering their services/goods through the Platform, for making sales to Users-buyers by concluding contracts at a distance. In the context of this policy, these can be: Individuals operating in their capacity as traders (sole traders, self-employed persons, etc.), as well as Individuals - managers and proxies of companies that work with the Platform in their quality as traders
Categories of data that can be processed: Names, Social Security Number/LNCH, Address, Telephone number, E-mail address.
Purposes of processing: Establishing and maintaining commercial relationships between the Administrator and Merchants-sellers; Signing contracts; Business communication; Providing the possibility to publish offers on the Platform, their service and support.
Storage period: 10 years after the termination of the legal relationship between the Company and the relevant Merchant-seller.
Legal basis for the processing: Execution of a contract between the Company and the relevant Merchant-seller.
Your rights
If we process your Personal Data, you have the following rights, which you can exercise by sending an application to the Company's address cited above, or by electronic means - to the e-mail address info@findly.bg, or via the Contact page :
Right of access to your personal data: You have the right to receive confirmation from us as to whether personal data about you is being processed and, if so, access to the personal data and information.
Right to rectification of personal data: If you find that the personal data we process about you is inaccurate, you have the right to request that we correct that personal data.
Right to erasure of personal data (the right to be forgotten): In certain circumstances, such as if your personal data has been processed unlawfully or you have withdrawn your consent (if the processing of personal data is based on consent) and there is no reason to continue processing, you have the right to request the deletion of your personal data by us.
Right to restriction of processing: In certain circumstances, such as if you doubt the accuracy of your personal data or you have objected to our legitimate purpose for processing your personal data, you have the right to request that we restrict the processing of your personal data until it is solution found.
Right to object to processing: In certain circumstances, such as if you doubt our legitimate interest in processing your personal data, you have the right to object, on grounds related to your particular situation, to such processing.
Right to data portability: If your personal data is processed by automatic means with your consent or for the purpose of fulfilling our contractual relationship, you have the right to request that we provide you with your personal data in a machine-readable format for transfer to another data controller.
Right to submit a complaint to a supervisory authority: You have the right to submit a complaint regarding the processing of your personal data by us to the relevant supervisory authority - Commission for the Protection of Personal Data, or to the court.
Joint Controllers of Personal Data (for data of Buyer Users)
When making a purchase and sale between a User-buyer and a Merchant-seller, by concluding a contract at a distance, this action gives rise to legal relations directly between the two parties. In the context of these legal relationships and for the purpose of fulfilling the contract, the Merchant-seller receives from the Platform partial data about the User-buyer (Names, sometimes also Telephone, Address, E-mail address - according to the specifics of the specific purchased service, its associated features, the need for advance booking and others). With this, the Merchant has the status of a Joint Controller of this data, within the meaning of the current legislation. As such, it has all the attendant duties and responsibilities. The company has explicitly informed the Merchant about them and secured his consent through a separate document.
Provision of Personal Data to third parties
The company does not provide data to third parties, except in the following cases:
The provision described in the previous article, which is necessary for the purposes of entering into
If we have a legal obligation to disclose or share data;
If we have obtained consent from the relevant Data Subject;
Digitally pseudonymized data about Visitors, Users and Subscribers to the Platform may be provided automatically to external services of our providers integrated into the Platform for the purpose of counting our attendance or for advertising purposes. More information about these external services can be found in the Cookie Policy, as well as opt-out settings for individual types of services. Such opt-out can also be done through external tools (for Google Analytics - here; for Google advertising platforms - here; for Facebook advertising platforms - here; for other platforms - here and here);
In certain circumstances, in order to send notification SMS or Viber messages to users by the Platform, GSM numbers are provided through a technical channel to external services of our SMS and Viber message providers, in order to carry out the sending itself. Such circumstances are, for example: If you have made a payment request with a deadline - to remind you that the deadline is approaching; If you use the "Send to SMS" option available with some functionalities on our site; If it is necessary to notify you of important information related to a purchase you have made; If you ask us to send you certain information via SMS or Viber. We do not send SMS notifications for advertising purposes;
If a user-buyer has made a payment, and subsequently this payment is investigated by a bank or payment institution or by a legal authority, due to suspicions of fraudulent or unrecognized payment or in the investigation of abuses, the Administrator may provide data of the User-buyer to the relevant bank or payment institution or statutory authority.
Data security
We have taken the necessary technical and organizational measures to ensure the protection of your Personal Data against unauthorized access or disclosure, accidental or unlawful destruction or alteration.
The information in electronic form is stored on secure servers on the territory of the European Union, installed in a professionally equipped and technically supported premises for the colocation of telecommunications equipment. The data transfer between the servers and the client device/browser is encrypted, via HTTPS.
Data of minors
The services provided by the Platform are intended for persons over 18 years of age.
If you are a minor, you may not use our services without providing the Administrator with express written permission from a parent or guardian. If you use our Platform without such permission, you are hiding important information from us and misleading us. In this case, the Company is not responsible for any circumstances or events arising as a result of this misrepresentation on your part.
As a Data Controller, we do not collect personally identifiable information from minors.
IP addresses
When the Company stores IP addresses of data subjects, this is done in order, if necessary, to provide adequate assistance to users in various circumstances (for example: forgotten accounts, duplicate registrations, purchases not found, inquiries about purchase statuses, etc.). IP addresses are stored for up to 1 year (this period is tailored to match the behavior of a part of the Platform's audience in terms of frequency of purchases and other actions). IP addresses are not provided to third parties under any circumstances, except for the exceptions described in Section III, Art. 4.
COOKIES
The websites of the Platform, as well as the external services used by them, provided by third parties, use cookies for the temporary storage of small pieces of information, in order to function correctly and provide the best possible services.
V. EXPLANATION OF CERTAIN PROCESSES AND TECHNICAL STEPS
1. When registering on the Platform
By registering on the Platform, the Visitor (Registered User) receives the so-called account consisting of two directions:
Private user profile: A separate part of the Platform, containing information about the user, required by the Administrator, stored with him, used and processed according to this Policy. Access to the user profile by the Registered User is carried out by entering the e-mail address and password specified by him and possibly through other technical mechanisms. The user profile also serves the communication between the User and the Administrator.
Public user profile: A separate part of the Platform, with social and marketing purposes, providing publicly partial information about the Registered User, including data specified by him - name, age, gender, place of residence, photos, as well as specific details about the purchases made by him through the Platform , as well as information about his public actions on the Platform, not protected by the Personal Data Protection Act and not prohibited by the Registered User through his profile settings, to which he has access at any time; as well as information about connections and interactions between the user and other users (online friendships). The Platform could use public data derived from users' activity and posts for profiling purposes, including by third parties at their discretion.
When a user registers on the Platform, he receives a common account for all sites that are part of the Platform. For more information about your ability to control your account settings, visit the Settings page (after logging into your account).
2. When registering on the Platform using external tools ("Login with Facebook", "Login with Google")
When a User for the purpose of registration (or subsequently after registration) uses the tools to create a connection between his account on the Platform and his Facebook or Google account, with this action he authorizes the Administrator to obtain partial data of him from his account in the relevant external service, allowed by the User for provision through his settings in the relevant external service, whereby:
The Administrator may receive User data such as Names, Gender, Age, Residence, Photo/Avatar, which data is added to the User's created account on the Platform.
The Administrator may receive the User's data on mutual relationships with other users (online friendships), which data is added to the User's data on the Platform
The Administrator may be enabled through the relevant external service to send notifications to the User, sent within the framework of the relevant external service, for communication or marketing purposes (for example: private notifications on Facebook).
The information that, through automatic technical means, the Administrator can receive and process in the manner described, is determined entirely by the User - through his settings within the relevant external service (Facebook, Google) in which he has an account and which account he has decided to connect with your account on the Platform. The registration of the user with these external services is taken as consent to the processing of the data provided through them.
3. When concluding a distance sales contract
By making a remote purchase, each user agrees that:
The act of concluding a contract at a distance with a Merchant-seller creates legal relations directly between the User-buyer and the Merchant-seller in which
With this, in order to fulfill the contract and as described, the Merchant-seller receives from the Platform partial Personal Data for the User-buyer, whereby the Merchant has the status of Joint Administrator of this data;
4. When posting user reviews
In certain cases, the User-buyer has the opportunity to publish his review and assessment of the Merchant-seller, in connection with a service purchased through a distance contract. Thus, the review published by the User becomes publicly available and publicly visible on the Platform, including: Its content, Name of the publisher, Photo/Avatar (if not prohibited by the user profile settings) and a link to the profile itself.
5. When subscribing to notifications
In addition to the possibility of E-mail subscription regarding this Policy, the Platform also supports alternative technical possibilities for a Visitor to subscribe to receive information. Such possibilities are the so-called Web-push notifications (browser notifications) and Mobile app notifications.
The way they work is as follows: The browser/device pops up a dialog box to the Visitor asking if they want to subscribe to this type of notification. If the Visitor confirms his wish, the subscription is created by generating a special key (token) in the browser/device, which is sent to the server and through which the server can subsequently send notifications.
At any time, the Visitor has the option to unsubscribe (unsubscribe from these notifications) through their browser/device settings. It is possible for the Platform to provide additional settings to the Registered User, through the settings in his account, with which he can customize or regulate the sending of notifications.
6. Links to external sites
Individual pages of the Platform may contain links/references/links to other (external) sites. They are part of content published on the Platform by third parties. If you visit an external site through a link available on the Platform, the Company is not responsible for the content of this external site, its services and functionalities, as well as its data protection policy. We advise you to always familiarize yourself with the policies of the sites you visit.
VI. FINAL PROVISIONS
1. You can find more information about the way the Platform works in the General Terms of Use of the site, of which this Policy is an integral part.
2. Any future changes to this Policy will be posted on this page.
