Personal Data Protection of Participants in the Campaign ‘Pay with IRIS Pay. Win Gold.’
- Privacy Policy
- License from the Bulgarian National Bank
- Terms and Conditions for the Use of the "Payment Terminal’ Product"
- Archive: General Terms and Conditions of 'Iris Solutions' Ltd regarding the use of the 'Payment Terminal' product
- Consumer Rights when Using Payment Services
- European Banking Authority
- “CAMPAIGN RULES ‘PAY WITH IRIS Pay. WIN GOLD.’”
- Personal Data Protection of Participants in the Campaign ‘Pay with IRIS Pay. Win Gold.’
- General terms and conditions: “Pay with your bank account and you could win gold” – UBB
- Privacy Policy “Pay with your bank account and you can win gold” - UBB Gold Partner
Mandatory information (Privacy Notice) on the personal data protection rights of the participants in the campaign "Pay with IRIS Pay, Win Gold"
“Iris Solutions AD”, UIC 208455895, with registered office and address: Sofia, 1164, Lozenets district, 78 Hristo Smirnenski Blvd., floor 4 (hereinafter referred to as the “Controller”, the “Company” or “We”), carries out its activities in compliance with the Personal Data Protection Act and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. This information is intended to inform you about all aspects of the processing of your personal data by the Company and the rights you have in relation to this processing as Participants in the "Pay with IRIS Pay, Win Gold" Campaign. ("The Campaign").
The Campaign is organized and conducted in accordance with the RULES OF THE CAMPAIGN "Pay with IRIS Pay, Win Gold" - that is only in relation to payments made during the period of the Campaign through IRIS Pay, from a payment account of the participant and the value of each payment is at least 10 (ten) euros.
Contact details of the Data Protection Officer:
Milen Minev
Email: milen@irisbgsf.com
Phone: +359 887 688 084
Website: www.irispay.bg
Contact details of the Controller:
“Iris Solutions AD”, UIC 208455895
Sofia, 1164, Lozenets district
78 Hristo Smirnenski Blvd., floor 4
What personal data, for what purposes and on what grounds do we collect and process about you?
The legal basis for data processing in connection with this Prize Campaign is Art. 6, para. 1, letter "f" GDPR - legitimate interest of the Company in conducting the Campaign and distributing prizes. The personal data of the winning participants is also processed on the basis of Art. 6, para. 1, letter "c" GDPR (legal basis) in cases where it is processed for the fulfillment of obligations of the Controller under the tax and accounting legislation or for data required by law for payment services and payment systems.
Notwithstanding the above, in order to contact a winning participant and award the prize, the participant's consent to the processing of personal data pursuant to Art. 6, para. 1, b. "a" of the GDPR is also required. Such consent may be withdrawn at any time. The provision of consent to the processing of the personal data described above is entirely voluntary. This means that if a participant does not wish to provide such personal data or consent to its processing, the data will not be processed in the manner described. However, in such case it will be impossible to contact the participant if he or she is selected as a winner and, consequently, to award the prize won. Despite the withdrawal of consent, the Company may continue to process personal data on another legal basis, such as compliance with a legal obligation, the performance of a contract or a legitimate interest.
The data of the winning participants, published on the website of IRISPay www.irispay.bg, is processed on the basis of Art. 6, para. 1, letter "f" GDPR, namely the legitimate interest of the Company. The legitimate interest of the Company is to announce the winners in the Campaign.
Categories of personal data processed:
1. To participate in the Campaign, including providing a prize, the Company collects and processes personal data, mainly:
1.1. Reference number of the participant's payment, which is generated through IRIS Pay, initials of the participant's names (first and last name), the credit or payment institution servicing the participant, as well as the IBAN of the account that was used to make the payment through IRIS Pay – the Company processes this data on the basis of Art. 6, para. 1, letter "f" of GDPR - legitimate interest for the purposes of your registration in the Campaign and individualization of a winning Participant.
1.2. The account IBAN of the winning participants and the initials of their names (first and last name) will be processed by Iris on the basis of Art. 6, para. 1, letter "f" GDPR – legitimate interest, for publication purposes on the website of Iris www.irispay.bg in order to provide an opportunity for the winning participants to contact the company in order to specify the method of providing the prize. The data will be disclosed in the following format: IBAN – first and last four characters (e.g. BG12xxxxxxxxxxxxxxxxx3456) and initials of names (e.g. A.B.).
1.3. The personal data of winning participants that will be processed for the purpose of awarding the prize are: full name, Personal Identification Number and place of residence. The Company processes such data only for winning participants who have provided them on the basis of Art. 6, para. 1, letter "a" GDPR – explicit consent - by filling in a consent declaration and/or a handover protocol. For the purposes of the taxation of prizes that are not of insignificant value within the meaning of § 1, item 62 of the Additional Provisions of the Personal Income Tax Act, the prizes awarded in this Campaign, namely 1 piece of gold investment bar (1 gram), are subject to final witheld tax under Art. 38, para. 14 in conjunction with Art. 65, para. 7 of the Personal Income Tax Act. Such tax shall be withheld and remitted by the Company at its own expense. In fulfillment of its obligation under the Personal Income Tax Act, the Company is required report the winning participant's full name, Personal Identification Number and permanent address in the statement under in reference to Art. 73, para. 1, item 2 of the Personal Income Tax Act regarding the income paid and tax withheld during the year. The legal basis for processing such personal data is Art. 6, para. 1, letter "c" GDPR.
The Controller does not process more data about you than is required for your participation in the Campaign.
The Controller does not process personal data of persons under the age of 18.
By participating in the Campaign, the Participants agree that in case of winning a prize, their initials or anonymized information about the IBAN of their accountsopened with credit or payment institutions could be used by the Organizer in audio, video, print and internet materials (including published on the Iris website in order to provide an opportunity for the winning participants to contact the company to provide a prize), for which he does not owe them payment.
How do we store your personal data?
The Controller stores your personal data as participants in the Campaign for a period of up to 1 month after the end of the Campaign.
The Controller stores the personal data of the winning participants in the Campaign for a period of 5 years from the end of the Campaign. The names of the winning participants (initials only) will be published for a period not exceeding 1 year after successful contact with all winners.
The personal data stored by the Controller on the basis of a legal obligation shall be stored until the expiration of the statutory deadlines.
We retain your personal data for the period necessary to fulfil the relevant purposes, unless a longer retention period is required by law or to protect our legitimate interests.
The Controller stores your personal data in a secure environment with controlled access, and has taken adequate measures to prevent unauthorized access or loss of your information, breaches in our information systems, data destruction, etc. In the event of a risk of infringement, we will take the necessary measures and notify you in a timely manner.
What rights do you have in relation to your personal data that we process?
By participating in the Campaign, you declare that you are informed of your rights under the requirements of the General Data Protection Regulation (GDPR), namely:
At any time, in accordance with the applicable legal requirements, any individual whose personal data is processed in connection with the Campaign may exercise the following rights by submitting a written request to IRIS Solutions AD, by sending an e-mail to the address indicated above, or in person at the Controller's registered office and principal place of business:
a) withdraw his/her consent to the processing of personal data with effect from now on, where the data processing is carried out on the basis of consent, without affecting the processing of personal data until the moment of withdrawal. In case of withdrawal of consent, the personal data of the data subject will be deleted and/or will cease to be used for the purposes specified herein, unless the Controller proves that there are legal grounds for the processing that take precedence over the interests, rights and freedoms of the data subject, or for the establishment, exercise or defense of legal claims;
b) inquire Iris Solutions AD whether his/her personal data is being processed and to receive a copy of the processed data, as well as information about the purpose of processing, as well as to whom they are or will be disclosed (right of access);
c) request the correction of an inaccuracy in his/her personal data processed or the completion of incomplete personal data in case of a technical error or inaccuracy (right to rectification);
d) request Iris Solutions AD to delete personal data related to him/her, for which there is no legal basis for processing, in respect of which he/she has withdrawn his/her consent to processing or to whose processing he/she has expressly objected (right to erasure);
e) request Iris Solutions AD to restrict the processing of his/her personal data (i.e. the personal data to continue to be stored by Iris Solutions AD without, however, otherwise being processed), when the accuracy of the personal data is disputed by the person or when the processing is unlawful and the person wishes his/her data to be stored in order to protect legal claims (right to restriction of processing);
f) request from Iris Solutions AD the personal data concerning it in a structured, widely used and machine-readable format (right to data portability);
You have the right to submit a report or complaint in case of concerns about a violation of your personal data protection rights to the competent regulatory authority: Commission for Personal Data Protection, Sofia. Sofia 1592, blvd. "Prof. Tsvetan Lazarov" No 2, www.cpdp.bg.
To whom can we transfer your personal data?
The Company processes your personal data as a controller and, if necessary and only for the purposes of conducting the Campaign and providing the prize to the winning participants, may transfer your personal data to third parties – processors of personal data. The Controller entrusts the processing of personal data only to companies or persons that provide a high level of protection of personal data.
It is possible that at the request of a state or judicial authority, as well as in the presence of a legal obligation, the Controller will have to disclose your personal data, including for the purposes of national security.