Privacy Policy, Personal Data Protection, and Cookie Usage

Privacy Policy, Personal Data Protection, and Cookie Usage

I. PERSONAL DATA ADMINISTRATOR INFORMATION

The Cultural Institute "REGIONAL CENTER FOR CONTEMPORARY ARTS 'TOPLOCENTRALA,'" (hereinafter referred to as "TOPLOCENTRALA") registered under the Law for the Development of Culture with regional cultural institute status, with BULSTAT 177517303, headquartered and managed at Sofia, Emil Bersinski St. No. 5, is the personal data administrator per Regulation (EU) 2016/679 of the European Parliament and Council of April 27, 2016, regarding the protection of individuals concerning the processing of personal data and free movement of such data and for the repeal of Directive 95/46/EC (hereinafter "the Regulation") and the Personal Data Protection Act (hereinafter "PDPA").

The website https://toplocentrala.bg/ is owned and operated by TOPLOCENTRALA in full compliance with the provisions of the Regulation and PDPA.

Contact details for the administrator: gdpr@toplocentrala.bg

II. PERSONAL DATA

According to the Regulation, personal data represents any information related to an identified or identifiable individual based on the relevant data.

III. PURPOSE

This Policy aims to inform you about the principles and manner in which TOPLOCENTRALA, as the data administrator, processes personal data, the types of data to be collected and processed, and the rights of individuals whose personal data is collected and processed. This Policy, among other things, is adopted and published in compliance with the obligations of TOPLOCENTRALA under Articles 13 and 14 of the Regulation.

If you have questions or need additional information regarding your personal data, rights, and privacy, please contact TOPLOCENTRALA using the contact details listed above in Section I.

IV. PROCESSING PRINCIPLES AND LEGAL BASIS

TOPLOCENTRALA considers the confidentiality and privacy of your personal information a priority and commits to complying with legal provisions for data protection. TOPLOCENTRALAdoes not sell personal data collected by TOPLOCENTRALAto third parties, nor does it process or provide these data to third parties without legal grounds for it, as per the Regulation and PDPA. TOPLOCENTRALA processes and provides personal data to third parties only when there is a duly legal basis for it, including explicit and freely given consent under the Regulation and/or other legal grounds for processing as stipulated by the Regulation and PDPA.

4.1. TOPLOCENTRALA's activities are entirely oriented toward the arts, preparation and realization of cultural projects, broadcasting and producing/co-producing cultural content, including organizing contemporary theater performances, educational events of all types, such as seminars, conferences, visualizations of various art types, musical and dance events. In connection with the above, TOPLOCENTRALAprocesses and protects personal data collected in the course of its activities in a lawful and purposeful manner, in accordance with the purposes for which the data is collected and/or has been collected.

4.2. Types of personal data collected and processed

Regarding data collected and processed through the aforementioned electronic site of TOPLOCENTRALA:

(1) On the electronic site

and/or

(2) By sending an electronic message to the email contact address listed on the website,

TOPLOCENTRALA collects and processes the following personal data from users:

Names, email address, phone number, and information (inquiry, request, or other) voluntarily provided by the user in the contact text field with TOPLOCENTRALA.

In cases of a candidate application to TOPLOCENTRALA, the same amount of data is collected, as well as data regarding the applicant's professional experience, including but not limited to: portfolio, photographs, video material, and others.

Regarding data collected and processed on TOPLOCENTRALAcustomers: TOPLOCENTRALA collects and processes the following personal data on customers:

Names, correspondence address (if necessary), email address, phone number, date of birth/ID number (if necessary and required to ensure minimum age for participation and/or attendance at an event).

If a client attends an event organized by and/or held in the objects of and/or organized by TOPLOCENTRALA, they may appear in photo and/or video material recorded in connection with the organized event, which may then be used by TOPLOCENTRALAfor marketing purposes. TOPLOCENTRALA complies with all the Regulation and PDPA requirements regarding the notification of individuals in this regard, informing them according to this Policy and visibly marking this information on its premises. In turn, by accepting this Policy and/or visiting the premises, individuals agree to be recorded, photographed, and/or filmed, retaining their rights as per national and international legislation in this regard.

Regarding data collected and processed on minors and/or adolescents by TOPLOCENTRALA: TOPLOCENTRALA collects and processes the following personal data on minors and/or adolescents, with the express consent of a parent/guardian, including: names, date of birth/ID number, address, gender, and the same personal data volume of the parent/guardian of the minor/adolescent.

Regarding data collected and processed on employees, contractors, and contractual partners of TOPLOCENTRALA: TOPLOCENTRALA collects and processes, for the purposes and needs of its activities, the following personal data from its employees and/or potential future ones and/or contractors: names, address, email address, date of birth/ID number, passport number / Personal Identification Number and/or other identity-verifying documents (if the employee is of non-Bulgarian origin), gender, bank account information, employment and/or professional experience, education and acquired degree, certificates, photographic and/or video material and/or personal portfolio based on their skills and past work and/or professional experience, information regarding activities on cultural projects, as well as all other documents and/or verifications about knowledge and skills, including recommendations/reviews from previous employers, partners, and/or clients of the contractor.

4.3. By accepting this Policy and/or the Terms and Conditions on the website of TOPLOCENTRALA, the electronic site users, including all clients, employees, and contractual partners of the latter (regardless of the method through which they contacted TOPLOCENTRALA and provided their personal data to TOPLOCENTRALA), consent to data provision, which forms a binding contractual clause between users of the electronic site/all other individuals or groups of individuals mentioned above and TOPLOCENTRALA.

The processing of the above personal data is to fulfill the corporate, business, administrative, and other operational purposes in TOPLOCENTRALA, including, but not limited to, services such as performance, organization, and participation in all types of cultural, musical, educational, dance, and other projects between TOPLOCENTRALAand the users of the electronic site, clients, employees, and contractual partners.

In providing data to third parties, it is done again per the above purposes, with the legal basis for data processing as per the purposes, subjects, and means being based on Article 6, para. 1, letter "b" of the Regulation.

Data provision is necessary for the organized and ongoing cultural and educational events identified above and is a contractual requirement, without which services could not be provided or participation as a client/visitor of TOPLOCENTRALA would not be possible.

4.4. TOPLOCENTRALA may be legally required to disclose personal data to third parties in the context of judicial, arbitration, or enforcement proceedings, or upon the request of a competent authority if necessary for national security, law enforcement, or other cases provided by legislation.

4.5. Personal data may also be disclosed if such disclosure is reasonably necessary to protect the legitimate interests of TOPLOCENTRALA.

4.6. TOPLOCENTRALA  processes personal data in strict compliance with the principle of maintaining a minimum of processed personal data, necessary for specific, justified, and legitimate purposes (the "need-to-know" principle).

4.7. TOPLOCENTRALA primarily processes personal data for:

Implementing corporate, business, administrative, and other operational processes at TOPLOCENTRALA;
Supporting its cultural activities;
Organizing any cultural or educational events in connection with fulfilling contractual agreements.

4.8 TOPLOCENTRALA retains personal data for as long as needed to achieve the purposes for which they were collected, including to comply with statutory, tax, labor, social security, and accounting requirements.

V. PURPOSES OF PERSONAL DATA COLLECTION AND PROCESSING

TOPLOCENTRALA collects and processes personal data necessary for carrying out its activities and fulfilling contractual obligations with partners, including but not limited to customers. Therefore, TOPLOCENTRALA processes personal data for the following purposes:

Registering users/customers on TOPLOCENTRALA's website, including when contacted via the website’s contact form or directly via email;
Preparing responses and taking action on inquiries, complaints, applications, etc., from users of the website/customers and/or potential/current contractual partners.

With the user's or customer's consent, or where legally permissible, TOPLOCENTRALA may use their personal data, specifically email addresses and names, for marketing purposes, including providing information, news, and offers related to TOPLOCENTRALA’s activities. Users who have agreed to receive such marketing information can withdraw their consent at any time through a provided link in each marketing email.

VI. CATEGORIES OF PROCESSED PERSONAL DATA

TOPLOCENTRALA collects the following categories of personal data from the four groups of individuals specified above in Section IV:

Names, email address, and phone number of users/customers of TOPLOCENTRALA's website or those contacting via direct email, regarding requests, complaints, reviews, etc., related to TOPLOCENTRALA's activities. In cases of job applications, this includes the same volume of data and any self-prepared portfolio based on professional experience;
Names, correspondence address (if necessary), email address, phone number, date of birth, or National ID number (when necessary, to ensure minimum age requirements for participation or attendance at events) as well as images or videos of clients;
Names, date of birth, National ID number, address, gender, and age of minors participating in or attending projects organized by TOPLOCENTRALA, with the explicit consent of a parent or guardian;
Names, address, email, date of birth, passport number, gender, bank account information, and records of professional experience, education, certificates, as well as any documents attesting to skills and experience, including testimonials from previous employers, partners, or clients of applicants/employees.

When users, customers, or applicants send inquiries to TOPLOCENTRALA via the contact form or email, it is presumed that they have given their informed consent to process any personal data included in their inquiries.

VII. COOKIES

Cookies are small information files sent from a web server and stored in the user's browser or hard drive, returning to the server each time the site is visited.

TOPLOCENTRALA’s website uses cookies to differentiate users, improve services, and enhance the website. Acceptance of this Policy regarding cookies occurs when users click on the popup message on TOPLOCENTRALA’s site or continue using the site. Users who disagree with this Policy must stop using TOPLOCENTRALA’s site immediately.

TOPLOCENTRALA may use first-party and third-party cookies for advertising purposes, categorized as follows:

Strictly Necessary Cookies: essential for site operation (e.g., login and order submission).
Analytics and Targeting Cookies: collect information to improve site navigation and user experience.
Functionality Cookies: provide additional features such as customization and saving preferences.

These cookies may be persistent (remaining on the device for a set period) or session-based (deleted immediately after closing the browser). All cookies on TOPLOCENTRALA’s website expire after six months.

Upon visiting the site, a popup appears to allow or deny cookies. Allowing cookies enables TOPLOCENTRALA to provide quality service and improve user satisfaction. Refusing cookies may restrict certain website functions.

Users can set their browsers not to store cookies or delete stored ones at any time. TOPLOCENTRALA is not liable if the user's browser lacks cookie control functions. If cookies are disabled or deleted, it may disrupt website functionality.

VIII. SECURITY MEASURES

TOPLOCENTRALA takes adequate technical and organizational measures to protect personal data from theft, unauthorized access, misuse, and other unlawful processing.

Representatives and employees of TOPLOCENTRALA, as well as contractual partners, must maintain confidentiality and comply strictly with data protection laws under the GDPR and the Bulgarian Personal Data Protection Act.

In cases where personal data is shared with third parties, TOPLOCENTRALA implements mechanisms, including contractual terms, to ensure that data is processed and protected under applicable law.

IX. RETENTION PERIODS

Personal data is retained only for as long as needed to fulfill its purpose unless a longer retention period is required by law.

After the statutory retention periods, as per Bulgarian accounting, financial, and tax legislation, TOPLOCENTRALA deletes personal data related to:

 inquiries, complaints, applications, or other communications through the contact form or email;
 administrative and operational activities;
 events or services conducted before, during, or after cultural and/or educational events or projects.

Personal data from online job applications is retained for six months unless an employment or other contractual relationship is established. If employed or involved with TOPLOCENTRALA, data is retained for five years following financial and accounting regulations.

X. RIGHTS REGARDING PERSONAL DATA

Under GDPR and the Bulgarian Data Protection Act, data subjects have the following rights:

 Access to their personal data processed by TOPLOCENTRALA;
Request correction, deletion, or restriction of personal data processing if legally justified;
 Data portability, where applicable;
 Object to data processing when legally justified;
 File a complaint with the Bulgarian Personal Data Protection Commission (CPDP) if rights are violated.

TOPLOCENTRALA may refuse requests when justified under GDPR, including cases of repetitive, excessive, or manifestly unfounded requests or if they compromise the rights and privacy of others.

XI. PROCEDURE FOR EXERCISING DATA SUBJECT RIGHTS

11.1. Data subjects may exercise their rights by submitting a request.

11.2. Requests can be submitted:

By email at gdpr@toplocentrala.bg
In person at TOPLOCENTRALA’s administrative office
By mail to TOPLOCENTRALA  at Sofia 1408, Emil Bersinski St. No. 5.

11.3. Requests should include:

 Identity information (name and ID);
 Contact information (address, phone, email);
 Request description.

11.4. TOPLOCENTRALA provides information on actions taken within one month of receiving the request.

11.5. This period may be extended by two months due to request complexity. The requester is informed within one month, along with the reasons for delay.

11.6. TOPLOCENTRALA may ask for additional information to confirm the identity of the data subject if reasonable concerns exist.

Requests submitted electronically are responded to electronically unless otherwise requested by the data subject.

XII. EFFECTIVE DATE AND UPDATES

This Policy is effective as of August 1, 2022. TOPLOCENTRALA may amend and update this Policy, with each change published on the official website, and may take other steps to notify users/clients/staff for the change.