Privacy Policy “Pay with your bank account and you can win gold” - UBB Gold Partner

Mandatory Information (Privacy Notice) regarding the data protection rights of participants in the campaign
“PAY WITH YOUR BANK ACCOUNT AND YOU COULD WIN GOLD”

 

“IRIS Solutions” AD, UIC 208455895, with registered office and management address: Sofia, postal code 1164, Lozenets District, 78 Hristo Smirnenski Blvd., floor 4 (hereinafter referred to for short as “Controller”, “the Company” or “We”) carries out its activities in accordance with the Personal Data Protection Act and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. This information aims to inform you of all aspects of the processing of your personal data by the Company and the rights you have in relation to this processing as Participants in the Campaign “Pay Directly. Win More.” (“Campaign”).

The Campaign is organized and conducted according to the CAMPAIGN RULES “PAY WITH YOUR BANK ACCOUNT AND YOU CAN WIN GOLD” — solely with regard to payments made during the Campaign period through IRIS Pay from a participant’s payment account, whose value is at least 10 (ten) euro.

Contact details of the Data Protection Officer:

Milen Minev, e-mail: milen@irisbgsf.com, telephone: +359887688084, website: www.irispay.bg,

Contact details of the Controller:

“IRIS Solutions” AD, UIC 208455895, with registered office and management address: Sofia, postal code 1164, Lozenets District, 78 Hristo Smirnenski Blvd., floor 4

What personal data, for what purposes and on what basis do we collect and process about you?

The legal basis for the processing of data in connection with this Campaign with prizes is Art. 6, para. 1, letter “f” GDPR — legitimate interest of the Company in conducting the Campaign and distributing prizes. The personal data of the winning participants are also processed on the basis of Art. 6, para. 1, letter “c” GDPR (legal basis) in cases where they are processed for the fulfilment of obligations of the Controller under tax and accounting legislation or for data required under the law on payment services.

Notwithstanding the above, for contacting a winning participant and receiving a prize, consent for the processing of personal data within the meaning of Art. 6, para. 1, letter “a” GDPR is also required. The consent may be withdrawn at any time. The provision of consent for the processing of the described personal data is entirely voluntary, which means that if the participant does not wish to provide the described personal data, they will not be processed in the described manner, but at the same time it will be impossible to contact him/her if he/she is a winning participant and respectively to receive the prize won. Despite the withdrawal of consent, the Company may continue the processing of personal data on another basis, for example a legal requirement, contractual relations or legitimate interest.

The data of the winning participants published on the IRISPay page www.irispay.bg are processed on the basis of Art. 6, para. 1, letter “f” GDPR, namely the legitimate interest of the Company. The legitimate interest of the Company is the announcement of the winners in the Campaign.

For participation in the Campaign, including the provision of a prize, the Company collects and processes personal data, specifically:

1.1. Reference number of the payment made by the participant, which is generated through IRIS Pay, initials of the participant’s names, the credit or payment institution servicing the participant, as well as the IBAN of the account that was used to make the payment through IRIS Pay — the Company processes these data on the basis of Art. 6, para. 1, letter “f” GDPR — legitimate interest, for the purposes of registering you in the Campaign and individualizing a winning Participant.

The information about the IBAN of the account of the winning participants will be provided on the basis of Art. 6, para. 1, letter “a” GDPR — explicit consent, to “United Bulgarian Bank” AD, UIC 000694959, with registered office and management address Sofia, postal code 1463, Triaditsa District, 89B Vitosha Blvd., with which the winning participant has an opened account, for the purpose of contacting him/her by the credit institution and conducting communication in connection with the Campaign. The information about the IBAN of the account of the winning participants may be processed jointly with other data about the respective participant that are already lawfully processed by the credit institution, insofar as this is necessary for the purposes of making contact and administering the process of providing the prize.

1.2. The data of winning participants that will be processed for the provision of a prize are: three names, Personal Identification Number (EGN), place of residence. The Company processes these data only from winning participants who have provided them on the basis of Art. 6, para. 1, letter “a” GDPR — explicit consent, by completing a declaration-consent and/or handover protocol. In connection with the taxation of non-cash prizes that are not of insignificant value within the meaning of § 1, item 62 of the Additional Provisions of the Personal Income Tax Act, the non-cash prizes in this Campaign, namely 1 investment gold bar (1 gram), are subject to taxation with final tax under the procedure of Art. 38, para. 14 in connection with Art. 65, para. 7 of the Personal Income Tax Act, which is withheld and paid by the Company — at its expense. In fulfilment of its obligation under the Personal Income Tax Act, the Company is obliged to indicate the three names of the winning participant, his/her Personal Identification Number (EGN) and permanent address in the statement under Art. 73, para. 1, item 2 of the Personal Income Tax Act for income paid during the year and tax withheld, whereby the basis for processing these personal data is Art. 6, para. 1, letter “c” GDPR (legal basis).

The Controller does not process more data about you than is necessary for your participation in the Campaign.

The Controller does not process personal data of persons under 18 years of age.

By participating in the Campaign, the Participants agree that in the event of winning a prize, their initials or IBANs of their accounts issued by credit or payment institutions may be used by the Organizer in audio, video, printed and internet materials, for which no payment is due to them.

How do we store your personal data?

The Controller stores your personal data, as participants in the Campaign, for a period of up to 1 month after the end of the Campaign.

The Controller stores the personal data of the winning participants in the Campaign for a period of 5 years from the end of the Campaign. The data for two names of the winning participants (initials only) will be published for a period not longer than 1 year after successful contact with all winners.

The personal data that the Controller stores on the basis of a legal obligation are stored until the expiry of the statutory periods.

We store your personal data for the period necessary to fulfil the respective purposes, unless a longer storage period is required by law or for the protection of our legitimate interests.

The Controller stores your personal data in a secure environment with controlled access, having taken adequate measures to prevent unauthorized access to or loss of your information, breaches in our information systems, destruction of data, etc. In the event of an established risk of a breach, we will take the necessary measures and notify you in a timely manner.

What rights do you have regarding your personal data that we process?

By participating in the Campaign, you declare that you are informed of your rights according to the requirements of the General Data Protection Regulation (GDPR), namely:

At any time, subject to compliance with the requirements of the applicable legislation, by sending a specific letter to the address of “IRIS Solutions” AD or via the e-mail address specified above, or on site at the registered office and management address of the Controller, every person whose data are processed in connection with the game has the right to:

a) withdraw his/her consent to the processing of personal data with effect for the future, where the processing of data is carried out on the basis of consent, without this affecting the processing of personal data until the moment of withdrawal. In the event of withdrawal of consent, the personal data of the data subject will be deleted and/or will cease to be used for the purposes specified here, unless the Controller proves that there are legal grounds for the processing that override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims;

b) send an inquiry to “IRIS Solutions” AD as to whether his/her personal data are being processed and receive a copy of the data processed, as well as information regarding the purpose of processing and to whom they have been or will be disclosed (right of access);

c) request correction of an inaccuracy in his/her personal data being processed or completion of incomplete personal data in case of a technical error or inaccuracy (right to rectification);

d) request from “IRIS Solutions” AD to delete personal data related to him/her for which there is no legal basis for processing, with respect to which he/she has withdrawn his/her consent for processing or against whose processing he/she has expressly objected (right to erasure);

e) request from “IRIS Solutions” AD to restrict the processing of his/her personal data (i.e. the personal data shall continue to be stored by “IRIS Solutions” AD without, however, being otherwise processed), where the accuracy of the personal data is contested by the person or where the processing is unlawful and the person wishes his/her data to be stored for the purpose of defending legal claims (right to restriction of processing);

f) request from “IRIS Solutions” AD the personal data concerning him/her in a structured, commonly used and machine-readable format (right to data portability);

You have the right to submit a signal or complaint in case of concerns about a violation of your personal data protection rights to the competent regulatory authority: Commission for Personal Data Protection, Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd., www.cpdp.bg.

To whom may we transfer your personal data?

The Company processes your personal data as controller and, where necessary and solely for the purposes of conducting the Campaign and providing the prize to the winning participants, may transfer your personal data to third parties — personal data processors. The Controller assigns the processing of personal data only to companies or persons that ensure a high level of personal data protection.

Personal data may be provided to the respective credit or payment institution with which the winning participant has an opened account from which he/she made the payment for participation in the Campaign, namely “United Bulgarian Bank” AD, UIC 000694959, with registered office and management address Sofia, postal code 1463, Triaditsa District, 89B Vitosha Blvd. The provision of these data is carried out for the purpose of contacting the winning participants and accepting the prize by them.

It is possible that, at the request of a state or judicial authority, as well as in the presence of a legal obligation, the Controller may have to disclose your personal data, including for the purposes of national security.