This privacy policy is adopted in accordance with the requirements of REGULATION (EU) 2016/679 of the European Parliament and Council and aims to inform you of your rights, regarding the processing of your personal data. Please read this document carefully, as it is designed to clarify the basic rules that Innocity Ltd. (hereinafter referred to as the ‘Company’) follows while collecting and processing your personal data.

I. CONTROLLER OF PERSONAL DATA

Name and legal form: INNOCITY Ltd.,
UIC: 204808426
seat and address of administration: Montana, 33, Nikola Vaptsarov Str., fl. 1
Represented by: Ivaylo Todorov Iliev
Person collecting and processing personal data: Ivaylo Todorov Iliev
Phone: 0894 52 88 62;
e-mail:office@innocity.bg

Innocity Ltd. is a company, registered in the Republic of Bulgaria, which, with the cooperation of the Municipality of Varna, is implementing the Varna City Card Program.

Varna City Card is a program, jointly implemented by Innocity Ltd., the Municipality of Varna, and their partners on the territory of the city of Varna, in which they provide for a fee, charged to the citizens and the guests of the Municipality of Varna, the opportunity to receive at preferential terms tourist, cultural and/or sports services, offered by the partners. Citizens and guests, who have bought Varna City Card receive the right to visit certain tourist sites in Varna (landmarks, museums, cultural monuments), and to get certain discounts at chosen units for relax and entertainment (points of interest). The services are used by purchasing and validating Varna City Card on technical or identification medium (cards, QR code, mobile application). In order to purchase and use Varna City Card, you must provide your personal data.

II. PERSONAL DATA

What does ‘Personal Data of Individuals (natural persons) mean – it means all data that can be used to identify one individual.
The personal data you provide to the Company by the registration in the Varna City Card mobile application or by registration on the website www.varnacitycard.com:

• Name
• Confirmation that you are at least 18 years of age *
• Email address
• Facebook/Google+ profile data **
Billing data – two names, address, telephone number and e-mail of the buyer***

* By using the Mobile application or the Website, by registering in it and by purchasing the Card, you confirm that you are at least 18 years of age. Only then you are allowed to use our services;

**By registration via Facebook/Google+, you provide some of your data from your profile account in one of these networks-name, email, profile picture and nationality /without nationality from Google+/.

*** Telephone number and e-mail are mandatory and the latter are to be use for contacting the buyer with regards to the purchase. Buyer’s e-mail may differ from the e-mail, used for setting up the profile account.

Optional data

Take notice that Users, registered on the Website, can also upload their picture in their account, as well as fill out a short description about themselves and fill in their website. The picture and other data are provided at their request and can be removed at any time. We do not need the picture, the short description nor the website in order to conclude and execute the card purchase agreement and the said data serves only to embellish the profile. Your photo and username will be visible to other users when you post a comment, review, or a rating. Your short description and website only serve to embellish your account and will not be shared with others.

Registered users in the Mobile Application can upload their picture in their profile account. This picture only serves to embellish the profile and is not visible to other users. We do not need the picture in order to conclude and execute the card purchase agreement, it is available only at your request and can be removed at any time. If you use your Mobile application account to post comments, reviews, or ratings on the Website, you are subject to the same rules as for registered users on the Website (see above paragraph).

There is an optional field on the Website for filling in ‘nationality’. If you choose to provide us with nationality data, it will only be used for statistical purposes and will be generalized and processed in a way that the data could not be associated with you.

FOR WHAT PURPOSE DO YOU PROVIDE YOUR PERSONAL DATA

1. / Conclusion and execution of a contract

You provide the abovementioned personal data in your profile (name, confirmation of required age, e-mail, data from your Facebook/Google+ profile account), because we need it to conclude a contract for the sale – purchase of Varna City Card and to identify you as a party to the set contract. Besides for the purposes of concluding the contract, your personal data is also collected for the performance of this contract, in which both parties – You, as a Buyer, and the Company, as a Seller, have the obligation to fulfill the terms within the specified deadlines.

Legal basis for processing – Art. 6, item 1, letter. “b” of Regulation 2016/679 of the European Parliament and of the Council; Obligations and Contracts Act; Commercial Act; Public Procedure Code; Measures Against Money Laundering Act;

2. / Operation of the Mobile application and the Website

After the mobile app is installed, it receives access to the following information from your device: Your device’s identifier – so we can link the actions you perform in the Application (pushing buttons, etc.) with your device and therefore – execute your requests; Incoming calls data – it allows you to receive calls while the application is active; Storage (phone disk space) – to install the application; Wi-fi and mobile Internet data – for Internet access from the Application. Access to this data is required for the operation of the Application and therefore we need this data in order to carry out the functions, set down in the Application.

By your usage of the Website, Innocity Ltd. receives access to your device’s identifier – so we can link the actions you perform in the Website (pushing buttons, etc.) with your device and therefore – execute your requests
Legal basis for processing – Art. 6, item 1, letter. “b” of Regulation 2016/679 of the European Parliament and of the Council;

3./Additional functions in the Application

With your consent *, we also receive access to your Location **, Photos and other media files ***, Camera – to capture a profile photo or to scan a Card from a technical medium.

* This data is collected to perform the functions you explicitly requested. Providing this data is not mandatory and your consent to use it may be withdrawn at any time. You can withdraw your consent via an email to us, from the Settings of your device or by uninstalling the Application. Since this data is collected only for the purpose of fulfillment of a specific additional function of the Application, requested by you, and this function cannot be executed without access to your data, upon withdrawal of your consent, Innocity Ltd. will stop providing you with the additional function, which the data was collected for.

** Access to Location is made to show you the tourist sites and points of interest near you. When you open the Map Menu, your location is used for the purpose of navigating you to the selected tourist sites and points of interest.

*** Access to photos and other media files on your device is made for the purpose of uploading a picture in your profile.

Legal basis for processing – Art. 6, item 1, b. “a” of Regulation 2016/679 of the European Parliament and of the Council;

4./Other information that you voluntarily provided us through the Website
Completing the optional fields of nationality, a brief description and a Website, or uploading a picture into your account through the Website constitutes consent to the use of this data by Innocity Ltd. for the purposes, outlined above in the current policies (statistical purposes for the nationality data, and respectively – embellishing the account, for the rest of the data). Publishing comments, reviews, and ratings on www.varnacitycard.com also constitutes consent to the processing of personal data you have provided in your comment, review, or rating. Providing this information is not mandatory and your consent to use it may be withdrawn at any time. You can withdraw your consent by sending us an e-mail or by deleting the data, using the settings from your profile (whenever possible).

Legal basis for processing – Art. 6, item 1, b. “a” of Regulation 2016/679 of the European Parliament and of the Council;

5. / Getting in touch with us

Any data you provide us through a correspondence, addressed to us, will be processed for the purposes you had in contacting us. These purposes may be: performance of the contract – when you have a request, regarding the services we provide; your consent – when the query is not directly related to our services; as well as any other reason, depending on your correspondence. The data you provide to us in this case will be processed according to the rules, outlined in these policies, including with accordance to our obligation to store your data and do not disseminate it (unless disseminating it is required for accomplishing the request in your query).

6. / Protection of the rights of the Company in case of non-performance of the contract

Besides for the conclusion and performance of a contract, your personal data is also collected in case of non-performance of this contract. This way, for the entire term of the contract, both parties to it – You, as a Buyer and the Company, as a Seller, have the obligation to fulfill the conditions, provided within the contract in the specified deadlines, and any action that deviates from the arrangement entitles each one of the parties to defend its rights in the appropriate manner, including by using the necessary personal data.
Legal basis for processing – Art. 6, item 1, letter. “f” of Regulation 2016/679 of the European Parliament and of the Council; Obligations and Contracts Act; Commercial Act; Public Procedure Code; Measures Against Money Laundering Act;

7. / Accounting and tax purposes

Data on the contracts, concluded between us, includin the billing data you provided, are stored and processed in relation to the obligations of all persons to perform and maintain tax accounting and to pay taxes. In this case, your personal data can be processed entirely for tax purposes.
Legal basis for processing – Art. 6, item 1, letter “c” of Regulation 2016/679 of the European Parliament and of the Council; Accounting Act; Corporate Income Tax Act; Income Tax Act of Individuals; Commercial Act;

8. / Statistical purpose

Following the completion of the agreement between us, the Company keeps your personal data for statistical purposes. In this case, pseudonymization is performed – your personal data is processed in such a way that it can not be linked to you and you can not be identified.

Legal basis for processing – Art. 6, item 1, letter. “f” of Regulation 2016/679 of the European Parliament and of the Council; Commercial Act;

HOW IS YOUR PERSONAL DATA COLLECTED

Your personal data will only be provided by you, at your request and upon confirmation by you, that you wish to enter into a contract for the purchase of Varna City Card. You choose how to provide us with your personal data – by signing up for the Varna City Card mobile application or on the Website www.varnacitycard.com, by signing in with a Facebook/Google+ profile, by email or in another suitable way.

By registering a profile and purchasing an identification medium, you provide your personal information. To complete your registration and to be able to use the Mobile application or the Website, you must agree to the use of your personal information as outlined above.

HOW DO WE STORE YOUR PERSONAL DATA

Your personal data is stored online, on the so-called cloud.

Innocity Ltd. has taken all necessary technical and organizational measures to protect your personal data, including through restricted access to the cloud, storage on a separated server, etc.

HOW LONG IS THE PERSONAL DATA STORED

Your personal data is stored for different terms, depending on the purpose for which it is collected.

1./ Conclusion, execution and protection of the rights of the Company in case of non-fulfillment of the contract of – term of up to 10 years from the date on which the full and final performance of the contract occurs by the parties or the termination of the contract on another ground.

In case of a breach of contract and one of the parties has taken actions to defend its rights by judicial, administrative or other manner – up to 5 years from the date of the final judicial, administrative or other act.

2. / Data needed to operation of the mobile application – we keep it until you delete the mobile app from your device.

3./ Providing additional features in the application – this data is deleted when you withdraw your consent for using it. The access to your location ceases at the moment of the withdraw of your consent. Old location data will be kept for 1 year and 6 months, after which it will be generalized and used for statistical purposes.

4. / Other information that you voluntarily provided through the Website – until your consent is withdrawn. Nationality data is kept for no more than 1 year and 6 months after receipt, and then aggregated and used for statistical purposes.

5. / Information from getting in touch with us – up to 5 years after concluding the issue you have approached us with, unless the matter falls under any of the other points of this section (in which case the data is processed for the period specified at the other point).

6./ Accounting and tax purposes – up to 10 years from the date of the last payment. If the revenue administration and or other public authorities initiate revisions and /or inspections, the period for the storage of personal data may be extended by the duration of the relevant state administration activities.

7./ Statistical purposes – up to 10 years from the date of purchase of the Card.

In case that there is a breach of contract and one of the parties has taken action to protect its rights in judicial /administrative or other manner to which Innocity Ltd. is a part of – up to 5 years from the date on which the final judicial, administrative or other act was issued.

HOW THE PERSONAL DATA IS DESTROYED

To avoid any unwanted negative consequences in relation to the processing of your personal data, by the expiry of the term for which the personal data are stored, the latter shall be destroyed / pseudonymized in such a way that you can not be identified.

DO WE PROVIDE DATA TO OTHER PEOPLE?

Your personal data may be provided to others, depending on the purposes for which the data is stored, namely:

1./ Concluding, implementation and protection of the Company’s rights in case of non-fulfillment of the contract for the sale-trade of Varna City Card on technical and information medium – for the conclusion of a contract for the sale-purchase of Varna City Card on technical and information medium (card, QR code, mobile application), for protection of the rights of one of the parties in the relevant judicial, administrative or other matter – to Attorney-at-law, notary, accountant / accountancy office, Registry Agency, court, prosecutor’s office, State Agency for National Security, established courier company, Bulgarian Posts Jsc, people responsible for technical and software maintenance of the equipment (IT specialists). In case you want to find the exact name of the people to whom your personal data has been provided, please contact us at the email, address and phone provided in section I above.

2. / Data from getting in touch with us – it will not be provided to others, unless providing it to others is necessary for completing the request in your query.

3./ Accounting and tax purposes – to accountants and accounting offices, to the competent state and municipal authorities upon request of them, e.g. National Revenue Agency, Local Taxes and Fees Department at Varna Municipality, State Agency for National Security and others.

4./ Statistical purposes – these data are not provided to other people, except for shareholders representing them, employees of the Company and the competent state and judicial authorities, if it’s necessary and requested by them.

ATTENTION: Your personal data may be provided to the Commission for the protection of personal data when exercising its powers of control over compliance with the provisions of Regulation (EC) 2016/679 of the European Parliament and of the Council.

III. WHAT ARE YOUR RIGHTS with reference to your personal data, processed by us?

1./ Right to access, correct, delete, limit the processing of your data

You have the right to receive information about whether we process your personal data, exactly which personal data we process, which person process it, whether it is provided to others, how long it is processed, what your rights are in relation to your personal data, whether you have the right to appeal. You may receive a copy of your personal data, which we process. In addition, you have the right to ask us to update/correct your personal information if the information we have is incorrect (for example, if you no longer use the old email address that we have for contacting you). You have the right to request from us not to take any action on your data but only to store it (the so-called restriction of processing) and to request the erasure of your personal data when it is no longer necessary for the purposes, for which they are being processed, and after the expiry of the period for which they are stored.

ATTENTION: You submit your personal data by your choice, based on your own decision, and Innocity Ltd. does not perform any profiling or automated processing of your personal data.

2./Right to data transfer

You have the right to receive your personal data that you have provided us with and which we process in a structured and widely used format. In addition, you are entitled to transfer your personal data under the previous sentence to other people and/or administrators, either personally or by transferring our data to another administrator you provide, if it’s technically possible.

3./ Right of objection

The provisions of the Regulation provide for your right of objection in cases where your personal data are processed for the performance of a public interest task or where the processing is necessary for the purposes or legitimate interests of the Company or a third party, when the legal bases for processing your data are based on Art. 6 (1) (e) and (f) of the Regulation. In such cases, you have the right to object and request that we discontinue the processing of your personal data. If you choose to file such an objection, we will review your request and respond to you in the appropriate order and within one month, unless it is technically necessary to take longer time.

4./ Right to appeal

You can file a complaint with the Personal Data Protection Commission to protect your rights and legitimate interests in relation to the processing of your data.

ATTENTION: If you need any further information regarding the collection, processing, storage, destruction or any other information related to your personal data, please contact us at the above address, phone number and e-mail address. Our team will answer all of your questions.