Mandatory information on the rights of individuals regarding the protection of personal data

I. General information

Art. 1. (1) "Shift Creative" EOOD (referred to in this document as "Molivnik" or the "Controller") carries out its activities in accordance with the Bulgarian Personal Data Protection Act and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

(2) As a personal data controller in the provision of hosting services, Molivnik meets all the requirements of the new regulation: it collects personal data only to the extent necessary to provide the service, and it keeps that data responsibly and lawfully.

II. Information about the owner

Art. 2. (1) Information about Molivnik:

Name: "Shift Creative" EOOD
UIC: 204415049
Registered address: Office A-20, Floor 9, Section A, Hebros Building, 154 Maritsa Blvd., Tsentralen District, Plovdiv 4000, Plovdiv Municipality, Plovdiv Province, Bulgaria
Correspondence address: Office A-20, Floor 9, Section A, Hebros Building, 154 Maritsa Blvd., Tsentralen District, Plovdiv 4000, Plovdiv Municipality, Plovdiv Province, Bulgaria
Email: office [at] molivnik [.] com

(2) Information about the Commission for Personal Data Protection:

Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
Tel.: +359 2 915 35 18, +359 2 915 35 15, +359 2 915 35 19
Fax: +359 2 915 35 25
Email: [email protected]
Website: http://www.cpdp.bg

III. Grounds for collecting, processing and storing your personal data

Art. 3. (1) Molivnik collects and processes your personal data in connection with entering into and performing contracts, providing hosting services, registering domains and providing virtual and dedicated servers, on the basis of Art. 6(1) of Regulation (EU) 2016/679 (GDPR), and specifically on the following grounds:

  • consent expressly given by you as a client;
  • the performance of a contract, or taking steps to enter into one, with a business partner;
  • taking steps at your request to enter into a contract, if you are applying for a job with us;
  • compliance with a legal obligation to which the Controller is subject;
  • the purposes of Molivnik's legitimate interests.

(2) Molivnik is the controller of your personal data as users of our services. With regard to the personal data that you process using our services, Molivnik acts as a processor.

IV. Purposes and principles of collecting, processing and storing personal data

Art. 4. (1) Molivnik collects and processes personal data when entering into a contract with a business partner or company/client in order to identify the contracting party and perform the contract, as well as for the following purposes:

  • accounting purposes;
  • statistical purposes;
  • protecting information security;
  • ensuring the performance of the contract for the relevant service;
  • sending informational messages, notices of changes to the service, recommendations for making better use of the platform, new and upgraded subscription plans, etc.

Art. 5. (1) Molivnik collects and processes the personal data that you provide when applying for a job, including for the following purposes:

  • identifying the applicant;
  • contacting and communicating with you;
  • selecting candidates.

(2) Molivnik keeps the personal data you have provided for the entire duration of the job advertisement. If we wish to continue storing your data after this period for the purpose of future communication with you, we will send you a request by email so that you can give your explicit consent for your data to continue to be stored.

Art. 6. (1) Molivnik observes the following principles when processing your personal data:

  • lawfulness, fairness and transparency;
  • purpose limitation;
  • relevance to the purposes of processing and data minimisation;
  • accuracy and up-to-dateness of the data;
  • storage limitation in view of the purposes;
  • integrity and confidentiality of processing and an appropriate level of security for personal data.

Art. 7. (1) When processing and storing personal data, Molivnik may process and store personal data to protect the following legitimate interests:

  • fulfilling its obligations to the National Revenue Agency, the Ministry of Interior and other state and municipal authorities.

V. What types of personal data does Molivnik collect, process and store?

Art. 8. (1) Molivnik performs the following operations with the personal data you provide as job applicants, for the following purposes:

  • entering into and performing a commercial transaction with a client or partner: the purpose of this operation is to enter into and perform a contract with a business partner or client and to administer it;
  • entering into and performing an employment or civil contract with a natural person: the purpose of this operation is to enter into and perform a contract with a natural person and to administer it;
  • sending informational messages: the purpose of this activity is to administer the sending of messages to clients about improvements or changes to the services, exceeded limits and expiring services, in accordance with the service contract.

(2) Molivnik processes the following categories of personal data and information, for the following purposes and on the following grounds:

  • your identification data (first name and surname, email address, telephone);
  • Purpose of collection: contacting the user and sending them information.
  • Grounds for processing your personal data: by accepting the terms and conditions and purchasing a service, a contractual relationship is created between Molivnik and you, on the basis of which we process your personal data — Art. 6(1)(b) GDPR.
  • other data processed by Molivnik: when you visit our website, Molivnik collects data about the IP address used;
  • Purpose of collection: improving the security of the service and localising the interface, statistical and marketing research.
  • Grounds for processing the data: processing is necessary for the performance of a contract to which the data subject is a party — Art. 6(1)(b) GDPR. Until a user profile is created, the IP address is collected on the basis of the legitimate interests of the controller — Art. 6(1)(f) GDPR;
  • your data for issuing an invoice to a natural person: if you wish to receive an invoice as a natural person, you must provide your Bulgarian personal identification number (EGN).
  • Purpose of collection: issuing an invoice for payments under a contract for services for the use of the online store builder platform.
  • Grounds for processing your personal data: by accepting the terms and conditions and registering on the website, or by entering into a written contract, a contractual relationship is created between Molivnik and you, on the basis of which we process your personal data — Art. 6(1)(b) GDPR.

(3) The Controller does not collect or process personal data that:

  • reveals racial or ethnic origin;
  • reveals political, religious or philosophical beliefs, or trade union membership;
  • consists of genetic or biometric data, data concerning health, or data concerning a person's sex life or sexual orientation.

(4) The personal data is collected by the Controller from the individuals to whom it relates.

(5) The Controller does not carry out automated decision-making using the data.

(6) The company does not process data of persons under 16 years of age, except with the explicit consent of their parents or guardians.

VI. Retention period of your personal data

Art. 9. (1) Molivnik keeps the personal data of the legal representatives of legal entities that are parties to a contract with the company indefinitely, for the purposes of protecting Molivnik's legitimate interests and fulfilling its legal obligations towards state authorities and institutions.

(2) Molivnik keeps your personal data as a job applicant for no longer than a current job advertisement is published on our website or elsewhere. After the advertisement expires or the selection process ends, Molivnik takes the necessary steps to delete and destroy all your data without undue delay, or to anonymise it (that is, to put it into a form that does not reveal your identity), unless you give your explicit consent for your data to continue to be stored and processed in the future.

(3) The Controller will notify you if the retention period needs to be extended in order to fulfil a legal obligation, in view of the Controller's legitimate interests, or for other reasons.

VII. Transfer of your personal data for processing

Art. 10. (1) Molivnik may, at its own discretion, transfer some or all of your personal data to processors in order to fulfil the purposes of processing, in compliance with the requirements of Regulation (EU) 2016/679.

(2) Molivnik will notify you if it intends to transfer some or all of your personal data to third countries or international organisations.

VIII. Your rights regarding the collection, processing and storage of your personal data

Art. 11. (1) If you do not want Molivnik to continue processing all or part of your personal data for a specific purpose or for all purposes, you may withdraw your consent to processing at any time by sending a request in free text.

(2) Molivnik may ask you to verify your identity and that you are the person to whom the data relates.

(3) Molivnik may continue to process some or all of your data if it is under a legal obligation to do so or in order to protect its legitimate interests.

(4) Paragraph 3 applies to legal representatives and to natural persons who are partners under a contract with the company.

Art. 12. (1) You have the right to request and obtain from the Controller confirmation as to whether personal data concerning you is being processed.

(2) You have the right to access the data concerning you, as well as information about the collection, processing and storage of your personal data.

(3) On request, the Controller will provide you with a copy of the personal data being processed concerning you, in electronic or another appropriate form.

(4) Access to the data is free of charge, but the Controller reserves the right to charge an administrative fee where requests are repetitive or excessive.

Art. 13. (1) You may correct or complete inaccurate or incomplete personal data concerning you by sending a request to Molivnik.

Art. 14. (1) You have the right to ask the Controller to erase some or all of the personal data concerning you, and the Controller is obliged to erase it without undue delay where one of the following grounds applies:

  • the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
  • you withdraw the consent on which the processing is based and there is no other legal ground for the processing;
  • you object to the processing of personal data concerning you, including for direct marketing purposes, and there are no overriding legitimate grounds for the processing;
  • the personal data has been unlawfully processed;
  • the personal data must be erased for compliance with a legal obligation under EU or member state law to which the Controller is subject.

(2) The Controller is not obliged to erase personal data if it stores and processes it:

  • for exercising the right of freedom of expression and information;
  • for compliance with a legal obligation which requires processing under EU or member state law to which the Controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller;
  • for reasons of public interest in the area of public health;
  • for archiving purposes in the public interest, for scientific or historical research or for statistical purposes;
  • for the establishment, exercise or defence of legal claims.

(3) If you exercise your right "to be forgotten", Molivnik will erase all your data except your full name as a job applicant, for accountability purposes.

(4) The data of the legal representatives of partner companies and clients under contract with the company continues to be stored and processed despite a request to be forgotten, on the grounds of compliance with the company's legal obligations, its legitimate interests and the establishment, exercise or defence of legal claims.

(5) To exercise your right "to be forgotten", you need to send a request in free text and prove your identity with an identity document.

Art. 15. (1) You have the right to ask the Controller to restrict the processing of data concerning you where:

  • you contest the accuracy of the personal data, for a period enabling the Controller to verify its accuracy;
  • the processing is unlawful, but you do not want the personal data to be erased and request the restriction of its use instead;
  • the Controller no longer needs the personal data for the purposes of the processing, but you require it for the establishment, exercise or defence of legal claims;
  • you have objected to the processing, pending verification of whether the Controller's legitimate grounds override your interests.

Art. 16. (1) You may at any time download the data stored and processed about you in connection with your use of Molivnik's services by sending a request by email.

(2) You may ask Molivnik to transfer your personal data directly to a controller of your choice, where technically feasible.

(3) You may exercise your right to data portability by sending a request in free text.

Art. 17. (1) You may ask the Controller to inform you of all recipients to whom the personal data whose rectification, erasure or restriction of processing you have requested has been disclosed. The Controller may refuse to provide this information if doing so would be impossible or would involve disproportionate effort.

Art. 18. (1) You may object at any time to the processing by the Controller of personal data concerning you, including where it is processed for profiling or direct marketing purposes.

Art. 19. (1) If the Controller becomes aware of a breach of the security of your personal data that is likely to result in a high risk to your rights and freedoms, it will notify you of the breach without undue delay, together with the measures taken or to be taken.

(2) The Controller is not obliged to notify you if:

  • it has implemented appropriate technical and organisational protection measures in respect of the data affected by the security breach;
  • it has subsequently taken measures which ensure that the breach is no longer likely to result in a high risk to your rights;
  • notification would involve disproportionate effort.

Art. 20. (1) To register a domain within or outside the .bg zone, and following a request from you, Molivnik transfers the necessary information to the relevant domain registrar, which processes your data as a controller for the purposes of registering the requested domain.

(2) The Controller does not transfer your data to countries outside the EU.

IX. Other provisions

Art. 21. (1) If your rights under the above or under applicable data protection legislation are infringed, you have the right to lodge a complaint with the Commission for Personal Data Protection, as follows:

Name: Commission for Personal Data Protection
Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
Tel.: +359 2 915 35 18, +359 2 915 35 15, +359 2 915 35 19
Fax: +359 2 915 35 25
Email: [email protected]
Website: http://www.cpdp.bg/

Art. 22. (1) You may exercise all your rights regarding the protection of your personal data in any form that contains a statement to that effect and identifies you as the data subject.

Art. 23. (1) When you instruct Molivnik to process the personal data of a third party for the purposes of using the service, Molivnik acts as a processor.

(2) In the cases under paragraph 1, Molivnik acts solely on your instructions as the user of the service, and only to the extent that it can control the personal data you process. Molivnik has no control over the content and data that you, as the user of the service, choose to upload to the service (including whether or not that data includes personal data). In this case, Molivnik plays no role in deciding whether the user uses the service to process personal data, for what purposes, and whether that data is protected. Accordingly, Molivnik's responsibility in this case is limited to:

  • following the instructions of the user of the service in accordance with the contract and the terms and conditions;
  • providing information about the service and its features through its interface.

Art. 24. (1) Molivnik's website may contain links to other websites operated by other organisations. We are not responsible for the security policies of other websites, even if you use links on our site to reach them. This Privacy Policy applies only to our site, so we encourage you to read the privacy statements of the other websites you visit.

(2) In addition, if you reached our website through a third party's site, we cannot be held responsible for the privacy policy and practices of the owners and administrators of that third party's site, and we recommend that you check its Privacy Policy.

Art. 25. (1) By using our site, you agree to our privacy statement.

Art. 26. (1) This Policy was last updated in September 2018 and complies with the General Data Protection Regulation (Regulation (EU) 2016/679). If we decide to change our privacy rules, we will publish the changes on this web page.