Privacy Policy

ninetynine.bg

PERSONAL DATA PROTECTION

PURPOSES

Ninety Nine collects and uses information for the following purposes:

  • Direct marketing;
  • Fulfilment of its contractual obligations to Users.

Ninety Nine processes Users’ personal data on the basis of the contract concluded between the User and Ninety Nine.

The User consents to the processing of their personal data for direct marketing purposes by ticking a checkbox.

The User may withdraw their consent at any time by sending an email to contact@ninetynine.bg or a written request to: 45 Krastyo Sarafov Street, Floor 2, Office 2, Sofia.

Users’ personal data is retained for a period of 5 years.

USERS’ RIGHTS

Every User of the website enjoys all personal data protection rights under Bulgarian legislation and European Union law. Every User has the right to:

  • Be informed (regarding the processing of their personal data by the controller);
  • Access their own personal data;
  • Rectification (if the data is inaccurate);
  • Erasure of personal data (the “right to be forgotten”);
  • Restriction of processing by the controller or personal data processor;
  • Portability of personal data between different controllers;
  • Object to the processing of their personal data;
  • Not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning the data subject or similarly significantly affects them; and seek judicial or administrative remedies if the data subject’s rights have been violated.

The User may request erasure if one of the following conditions applies:

  • The personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
  • The User withdraws the consent on which the processing is based, and there is no other legal basis for the processing;
  • The User objects to the processing and there are no overriding legitimate grounds for the processing;
  • The personal data has been processed unlawfully;
  • The personal data must be erased to comply with a legal obligation under Union or Member State law applicable to the controller;
  • The personal data was collected in connection with the offer of information society services to children, and consent was given by the person holding parental responsibility for the child.

The User has the right to restrict the controller’s processing of their personal data when:

  • The User contests the accuracy of the personal data. In this case, processing is restricted for a period enabling the controller to verify the accuracy of the personal data;
  • The processing is unlawful, but the User does not wish the personal data to be erased and instead requests restriction of its use;
  • The controller no longer needs the personal data for processing purposes, but the User requires it for the establishment, exercise, or defence of legal claims;
  • The User has objected to processing, pending verification of whether the controller’s legitimate grounds override the User’s interests.

 

Right to data portability.

The data subject has the right to receive the personal data concerning them which they have provided to a controller, in a structured, commonly used and machine-readable format, and has the right to transmit that data to another controller without hindrance from the controller to which the personal data was provided, where processing is based on consent or a contractual obligation and is carried out by automated means.

In exercising the right to data portability, the data subject also has the right to have the personal data transmitted directly from one controller to another, where technically feasible.

Right to object

Users have the right to object to the processing of their personal data by the controller. The personal data controller must cease processing unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or grounds for the establishment, exercise or defence of legal claims. Where an objection concerns the processing of personal data for direct marketing purposes, processing must cease immediately.

Complaint to the supervisory authority

Every User has the right to lodge a complaint concerning unlawful processing of their personal data with the Commission for Personal Data Protection or the competent court.

OBLIGATIONS OF THE PERSONAL DATA CONTROLLER:

The personal data controller has the following obligations:

  • Process data in accordance with the personal data protection principles established in the Regulation and be able to demonstrate compliance (accountability);
  • Ensure data protection by design and by default;
  • Notify the supervisory authority and the data subject in the event of a personal data breach, and document every personal data breach, including the facts relating to the breach, its consequences, and the measures taken to address it;
  • Carry out a data protection impact assessment;
  • Implement appropriate technical and organisational measures to ensure data security, including:
    • Restricting access to authorised persons only;
    • Ensuring the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
    • Restoring availability of and access to personal data in a timely manner in the event of a physical or technical incident;
    • Regularly testing, assessing and evaluating the effectiveness of technical and organisational measures;
    • Cooperating with the personal data protection supervisory authority in fulfilling obligations arising from the Regulation;
    • Developing and implementing internal procedures for receiving, reviewing and responding within one month to Users’ requests to exercise their rights as personal data subjects.

 

MAINTAINING A REGISTER

Ninety Nine maintains a register of the processing activities for which it is responsible. This register contains all of the following information:

  • The name and contact details of the controller;
  • The purposes of processing;
  • A description of the categories of data subjects and the categories of personal data;
  • The categories of recipients to whom the personal data has been or will be disclosed, including recipients in third countries or international organisations;
  • Where possible, the envisaged time limits for erasure of the different categories of data;
  • Where possible, a general description of the technical and organisational security measures.

 

REGULATORY AUTHORITY

The authority regulating Ninety Nine’s activities is the Commission for Personal Data Protection (CPDP), with the following contact details:

For the CPDP:

  • Website: https://www.cpdp.bg/
  • : 02/91-53-518
  • Email: kzld@cpdp.bg
  • Address: 2 Prof. Tsvetan Lazarov Boulevard, Sofia 1592, Bulgaria

 

Cookie Policy

Use of Cookies

Cookies are short text files or small packets of information stored through the internet browser on your device (computer, tablet, laptop or mobile phone) when you visit different websites and pages on the internet. The main purpose of cookies is to enable a website to recognise a user when they return.

Some cookies also have more specific uses, such as remembering user behaviour on the website and making it easier for users to use the website. More information about how cookies work can be found online.

How are cookies used on this Website?

We use cookies on this Website primarily to make the site easier to use, improve its performance and store information about user behaviour. No personal data is stored during this process; in other words, we cannot identify you personally through the Website’s cookies, and therefore the Personal Data Protection Act does not apply to the collection of this information. Information collected through cookies is generally used in aggregated form to analyse user behaviour on the Website, enabling us to improve the Website’s functionality, user journeys and content.

What types of cookies are used on this Website?

Session Cookies

These cookies make the website easier to use by storing information temporarily, only for the duration of the browser session. Typically, the information stored includes which pages of the website you have visited and how you reached particular information. These cookies do not collect information from your device and are automatically deleted when you leave the Website or end your browser session.

Persistent Cookies

These allow us to store specific browsing information, such as an analysis of visits to the website, how you arrived at the Website, which pages you viewed, which options you selected and where you navigated from this Website. Tracking this information allows us to improve the Website, including fixing errors and expanding content. The retention period for these cookies varies according to their specific purpose.

Third-Party Cookies

Our Website contains links to other websites or embedded content from other websites, such as YouTube, Google, LinkedIn and partner websites. When you visit those websites or open content from them, cookies from those websites may be stored on your device. These are known as third-party cookies, and we have no control over their creation or management. We therefore advise you to consult the relevant third parties’ websites for information about these cookies and how to manage them.

How can I manage the use of cookies on this Website?

All browsers allow cookies to be managed through a dedicated section of your browser settings. You can block cookies, delete all or some of them, or set your cookie preferences before visiting our website. Please note that deleting or blocking cookies may adversely affect the functionality of our Website and, consequently, your experience using it.

Disabling or Blocking Cookies

Cookies can be controlled, disabled or blocked through your browser settings. Please note that completely disabling all cookies may affect the Website’s functionality, performance and access to certain information.