PRIVACY POLICY

The protection of personal data and the non-disclosure of personal and financial information of our clients is our priority. We process your data exclusively based on the applicable legislation, specifically REGULATION 2016/679 EU of the European Parliament and of the Council from 27.04.2016 (also known as GDPR), the Personal data protection act and the E-commerce act. 

I. WHO IS PROCESSING AND WHO BEARS LIABILITY ABOUT YOUR PERSONAL DATA

BALKAN OPHTHALMIC WETLAB  /Wet Lab/ is a trademark, owned by “EDUCATIONAL CENTER IN OPHTHALMOLOGY RESBIOMED” SPLtd, UIC 201147514, which is a trade company with seat and address: Sofia, district Vazrazhdane, Pozitano str. 136A, floor 1, established and operating according to the Bulgarian legislation.

Phone: +359 (0) 2 80 81 888
Mob.:+359 (0) 879 600 299 
e-mail: admin@bow.bg
Website: https://bow.bg

The services, which we are providing for you, namely: courses targeted at practical education for doctors in order to improve their qualification and professional skills require the processing of your personal data by “EDUCATIONAL CENTER IN OPHTHALMOLOGY RESBIOMED” SPLtd in its capacity as “CONTROLLER” of personal data when observing the requirements for personal data protection according to GDPR.

II. TYPE OF DATA, WHICH WE PROCESS

“EDUCATIONAL CENTER IN OPHTHALMOLOGY RESBIOMED” SPLtd processes the following types of personal data in order to provide accurately the offered service, namely:
- three names
- title
- place of work /medical centre/ 
- address
- phone number
- Email
- personal identification number or foreigner’s personal number or equivalent /when issuing invoice/
- bank account number
- Photos or videos /from previous courses and public events/. 

III. PROCESSING GROUNDS

“EDUCATIONAL CENTER IN OPHTHALMOLOGY RESBIOMED” SPLtd is processing your personal data on the grounds of art.6, para.1,b.”a”b. “b “. b. “c” and b. “e” of GDPR, namely:
- art.6, para.1 b. “a” of  GDPR – you have given your consent for the processing of your personal data for the purposes of direct marketing – advertisements, commercial messages, promotions, offers etc. The data being processed on this ground is e-mail and two names.
- art.6, para.1 b. “b” of  GDPR – the processing is necessary for the execution of a contract for education, in which you are one of the sides or for the undertaking of actions according to your request prior to the conclusion of a contract. The data, processed on this ground is the  data, described in details in section II.
- art.6, para.1 b. “c” of  GDPR – processing is necessary to comply with a legal obligation that applies to the CONTROLLER, such as accounting obligations for commercial activities. The data processed on this ground is: three names, permanent address, personal ID number or personal number of a foreigner, bank account number.
- art.6, para.1 b. “e” of GDPR – the processing is necessary for the purposes of the legitimate interests of the CONTROLLER, unless the interests or the fundamental rights and freedoms of the data subject have priority over such interests. The data processed on this ground is: photos and videos from conducted courses and public events.

IV. PURPOSE OF THE PROCESSING

A/ When concluding and executing a training agreement by conducting a specific course or another event by the CONTROLLER, the purposes of the data processing are:
- Customer / user/ identification;
- Service and response to customer complaints / inquiries / applications under Art. 15-22 of GDPR / Complaints;
- Adjustments of due amounts if the requirements are met;
- Payment of amounts under contracts;
- Data processing by the data processors – assignment, accounting, acceptance, payment.

B/When executing its legal obligations, the CONTROLLER processes your data for the following purposes: 
- invoice issuing
- financial and accounting processing of the contract with the client and for tax and social insurance control by the respective authorities;
- fulfillment of the accountability obligation of the Controller by recording legally significant authentication data in electronic protocols - technical logs.

C/ Considering the legitimate interests of the CONTROLLER, the data is being processed for the following purposes, namely:
- Covering all matters related to client complaints.
- Sending of messages for promotions, offers, commercial and/or information messages.
- Publishing of photo material or motion picture from previous courses and public events aiming to increase the CONTROLLER’s popularity.

V. DATA COLLECTING METHOD

“EDUCATIONAL CENTER IN OPHTHALMOLOGY RESBIOMED” SPLtd is processing only data provided by you. Therefore, you must not provide third person’s data in collision with their rights of personal data protection, as the CONTROLLER has no access to these persons and there is no practical possibility to control whether our clients provide data of third parties with their knowledge and consent given in accordance with the legal requirements.
Therefore, each data subject bears full personal responsibility if he provides us with third party’s data without his knowledge or without obtaining his consent in fulfilling the requirements of the applicable data protection legislation, including with regard to names, telephones, electronic addresses, bank account numbers, personal identification number, or personal number of a foreigner.

VI. WHERE WE STORE YOUR DATA

The data, which we collect from you, is stored within the European Economic Area (EEA) while observing the national and the European legislations, specifically REGULATION 2016/679 EU of the European Parliament and the Council from 27.04.2016 (also known as GDPR)

VII. SECURITY MEASURES

THE CONTROLLER declares that technical and organizational measures are introduced in order to protect your personal data against loss or other forms of illegal processing in accordance with art. 32 GDPR.
Personal data is accessible only to those persons, who require access in order to perform their work in connection with the realization of our services. These persons are trained and authorized accordingly.

VII. WHO HAS ACCESS TO YOUR DATA

The CONTROLLER does not provide your data to third parties without any legal or contract grounds, as well as he does not disclose data in third countries and international organizations outside the borders of the EU and EEA.

Your data may be provided to other data processors only for the purposes of the provision of the service, which you have chosen or for marketing campaigns aimed at enhancing the quality of the services provided or in order to fulfill the legal obligations of the CONTROLLER, namely:
- CONTROLLER’s employees;
- Lecturers in the respective course;
- Technical support companies such as maintaining of POS systems and when providing IT maintenance and communication;
- The banks, servicing payments, made by you.
- Persons performing consultancy services in various spheres - legal, accounting, auditing, incl. enforcement of receivables, etc.
-  State administrative bodies - NRA, CPDP, etc., where applicable in cases provided by law.

IX. PROCESSING AND STORAGE TERMS. CLEARING OF DATA.

After the termination of the particular contract, respectively after the finish of the current course or after your consent has been received, your personal data is stored for the following terms:
- 10 years for accounting documents, as of the beginning of the year following the year, in which the document has been issued – two names, PIN or personal number of a foreigner, bank account number.
- 5 years from the performance of a specific contract, aiming to track the execution and to cover all issues related to complaints and juridical claims - two names, telephone number, address, e-mail, place of work / medical institution/.
- 3 years from receiving the consent - for e-mail and name regarding the sending of commercial and advertising messages, information materials, polls and more.

The destruction of the personal data shall be carried out in compliance with a specific procedure for this, according to the internal documents of the CONTROLLER.

XI. YOUR RIGHTS

You are provided with the following rights regarding your personal data. Below is information about the nature of these rights and how you can exercise them.

1. Right of access of the data subject

You are entitled to receive information from “EDUCATIONAL CENTER IN OPHTHALMOLOGY RESBIOMED” if the company or another person, acting on its behalf, processes your personal data and if so – to receive description of the personal data, the purposes, for which the data is processed and to be notified about the possible recipients and sources of the respective personal data.  You also have the right to receive a copy of this personal data.

2. Correction, erasure and clearing

If you believe that the information available to the CONTROLLER is incorrect, it shall be corrected accordingly.

You are entitled to exercise your right for the clearing of your personal data (also known as the right to be forgotten”). Under certain circumstances, the deleting may not be possible, for example when we need to keep your personal data to comply with legal or regulatory obligations. In such cases, the CONTROLLER will notify whether the deletion is possible and, if not, will explain why.

3. Right of limitation

You may ask the CONTROLLER to limit the processing of your personal data under the following circumstances:
a) the accuracy of your personal data is disputed by the data subject, for a term, which allows the administrator to check the accuracy of the personal data;
b) the processing is not permitted, but the data subject does not want the personal data to be deleted, but instead requires a limitation of their use.
c) the controller no longer requires personal data for the purposes of processing, but the data subject requests them for the establishment, exercising or protection of legal claims;
d) the data subject has objected to the processing under Art. 21 (1) of the GDPR pending verification that the legitimate grounds of the controller have an advantage over the interests of the data subject.

4. Right of portability:

When the CONTROLLER processes your personal data in an automated manner based on your consent or on the grounds of a contract, you are entitled to receive a copy of your data in a structured, widely used and machine readable format transferred to you or to another party. This includes only the personal data you have provided us with.

5. Right to object to processing on the basis of a legitimate interest:

You are entitled to make an objection against the processing of your personal data based on the legitimate interest of the CONTROLLER. We will not continue to process your personal data unless proven that there are compelling legal grounds that have priority over your interests and rights or because of legal claims.

6. Right to be informed about a violation under Art. 34 from GDPR:

When the breach of personal data security is likely to result in high risk for your rights and freedoms, the CONTROLLER without unnecessary delay informs the data subject about the personal data breach and describes the nature of the security breach of the personal data and shall indicate at least:
- the name and contact details of the official from whom more information may be received;
- the possible consequences of the breach of personal data security;
- a description of the measures taken or proposed by the controller to address the personal data breach, including, where appropriate, measures to reduce the possible negative consequences. 

The above information will not be sent in case of security breach when the CONTROLLER has fulfilled any of the following conditions:
a) has taken appropriate technical and organizational protection measures and these measures have been applied to personal data affected by the personal data breach, in particular measures that make personal data incomprehensible to any person not authorized to access such as encryption or
b) has subsequently taken measures to ensure that the high risk to the rights and freedoms of the data subjects referred to above is no longer likely to materialize; or
c) the notification would lead to disproportionate efforts.
In the latter hypothesis, the CONTROLLER will publish a message on its site so that the data subjects are equally effectively informed.

XII. EXERCISING OF YOUR RIGHTS

We take very seriously the protection of personal data, therefore we have a customer service team handling your requests in relation to the above stated rights. You can always contact them at the following contacts:
Tel. +359 (0) 2 80 81 888
Mob. +359 (0) 879 600 299;
e-mail: admin@bow.bg

Please keep in mind that when your requests are clearly unreasonable or excessive, in particular due to their repeatability, we can:
1. charge a fee, considering the administrative costs of providing the information or communication or taking action, or
2. refuse to take action on the request.

We will undertake reasonable efforts to respond to your request within 30 days of receiving your application. If necessary, this period may be extended by a further two months, taking into account the complexity and the number of requests.

XIII. WITHDRAWAL OF CONSENT

You may at any time withdraw your consent for the processing of your personal data only for those purposes and this personal data necessary to achieve the particular purposes we process on the basis of Art. 6 (1), b. "A" of the GDPR detailed in sections III and IV of this policy.
In case you wish to withdraw your consent for the processing of the following personal data, namely: e-mail and name for sending commercial and advertising messages, information materials, questionnaires, etc., you can submit a written request to the specified above mail or follow the active link where you fill out our sample withdrawal form. Once sent, you will not receive commercial communications and information from the CONTROLLER, and the data will be deleted unless processed on other grounds and for other purposes as outlined in sections III and IV of this document.

XIV. SIGNALS OF IRREGULARITIES AND COMPLAINTS

If you believe that we have violated your rights with regard to your personal data and that there is a risk of breaching the security of your personal data, you may report to the following contacts:
Tel. +359 (0) 2 80 81 888
Mob. +359 (0) 879 600 299;
e-mail: admin@bow.bg

The exercising of the above rights does not deprive you of the right to file a complaint. You can submit it to the Bulgarian supervisory authority - the COMMISIION FOR PERSONAL DATA PROTECTION. More information can be found at www.cpdp.bg