Personal data protection policy

PRIVACY NOTICE of E-CREATE LTD

This privacy notice provides information to our customers, individuals, about how E-CREATE LTD (the Company) collects, uses, shares and protects your personal data in the course of its activities. The privacy notice complies with the legislation in force in the Republic of Bulgaria in relation to the protection of personal data.
We encourage you to familiarize yourself with it and review it periodically, as we may change it for greater completeness and clarity.

GENERAL INFORMATION

When you contact us in person or through an intermediary to express a desire for lessons or another service, to ask us questions by phone, email or through the site, or to assert your rights, and when we commission you to perform a service, You you provide us with certain information about yourself - such as names, social security number, address, etc. In cases where you contact us through our site by sending us an inquiry or email, we may collect your IP address.

WHAT PERSONAL DATA WE COLLECT

The personal data we collect is defined in the relevant Bulgarian legislation, the relevant declarations of consent for the processing of personal data, contracts concluded between the Company and you and other documents. Personal data may be, for example:

Names, SSN, LHR, UIC or other identification number, and relevant information contained therein, such as date of birth, gender, date and place of birth, data from an identity document in cases required by law, etc. - for accounting purposes, to fulfil legal and/or contractual obligations, etc.
Email address, permanent address, current address, tax address and/or correspondence address - for contact with you and in connection with the performance of our contractual and legal obligations; telephone number - for contact when required, for the performance of services commissioned by you, for the provision of information and/or response upon request or necessity
Other information that you voluntarily provide to us.

In each case, we collect only those personal data that are necessary in order to comply with legal requirements and to fulfil our obligations.

HOW WE COLLECT AND USE YOUR PERSONAL DATA

We collect and use your personal data to carry out our business and to provide you with our services in the best possible way for you, such as with a PURPOSE:

To provide you with our services that we carry out and that you have requested, including notifying you of remaining prepaid lessons or subscription renewal periods etc.;
To provide you with information in relation to those services, including for direct marketing purposes through communication channels such as telephone, SMS, email;
To contact you when you have asked us a question or made a request for a quote for a service or a complaint, or to notify you of important changes to our business or data breaches;
To conduct our business in accordance with the requirements of applicable law and professional standards and rules, to avoid conflicts of interest, corrupt practices and to carry out our legal obligations, to respond to requests from domestic or foreign regulatory, governmental or judicial authorities;
To improve the services we provide to you, including for internal purposes such as analytics and research to help us improve our operations or to monitor and analyze trends and usage of our services;
In connection with legal claims, to protect our interests in litigation or other proceedings brought by competent authorities, and for the purposes set out elsewhere in this Notice.

Where we process your personal data for the purposes of our core teaching activities, and to comply with our legal obligations, such processing is necessary to fulfil those purposes. Without this data, we would not be able to provide you with the relevant services. So, for example, if you do not provide us with your name, ID number and address, we would not be able to issue an invoice for a subscription for consecutive lessons. In other cases, when collecting your personal data, we would let you know whether providing the data is necessary and what the consequences are if you refuse.

If you have expressly consented to receive free notifications in a particular way, you may withdraw your consent at any time.

We would update the above information periodically in case it is necessary in connection with changes in our business or in the relevant legislation, so that you can have accurate information at all times about the purposes for which we process personal data.

In the event that we would wish or need to collect, use or process the data you have provided for purposes and in a manner significantly different from that for which we have notified you, we would inform you promptly and seek your consent where necessary.

We process your personal data on one or more of the following BASES:

Your explicit informed consent provided for certain purposes, for example to receive communications from us about remaining prepaid lessons, information about news and promotions from us and our partners; correspondence by email, post or via our website in relation to enquiries made or in order to offer our services; the consent you have provided can be withdrawn at any time and, in the absence of a legal bar to this, we will cease to process your data subject to the withdrawn consent in the future.
- For the performance of our contractual obligations;
In connection with and for the performance of another contract to which you are a party;
- For the performance of our legal obligations, for example in connection with obligations under the - Accounting Act and the Tax and Social Security Procedural Code or in providing information to judicial and other government authorities;
- For the protection of your or another individual's vital interests;
- To perform tasks of public interest;
- For the purposes of our or a third party's legitimate interests, except where they are overridden by your interests or your fundamental rights and freedoms. Examples of our legitimate interests include improving the quality of our service (for which we may, for example, record conversations with customers); in establishing, exercising and defending legal claims.

HOW LONG WE KEEP YOUR PERSONAL DATA

We retain and process your personal data for as long as is necessary for the processing purposes for which we collected it and for any other permissible and related purpose, or until the expiry of a legally specified period.

The minimum retention period for your personal data is the duration of your contractual relationship with us.
It is in our legitimate interest to retain certain personal data until the limitation period for making claims (5 years) has expired following the expiry or termination of our contracts with you.

We will not erase or anonymise your personal data if it is necessary for a pending judicial or administrative proceeding or a proceeding to address your complaint.

HOW SECURE YOUR PERSONAL DATA IS

We understand how important the security and protection of your personal data is to you.
That is why we take very seriously the establishment and maintenance of numerous physical, technical, personal and organizational measures to protect your personal data from unauthorized access, use or disclosure. We require our suppliers and partners who have access to your personal data to use appropriate measures to ensure the protection and confidentiality of your personal data.

Unfortunately, the transmission of information over the Internet or by telephone may not be completely secure despite the measures we have taken. Therefore, please note that transmission of your personal information over the Internet or by telephone is done at your own risk.

TO WHOM WE PROVIDE YOUR PERSONAL DATA

In connection with the nature and organisation of our business, we may provide your personal data to various persons for the purposes set out above, such as:

Our partners and their representatives, for the purposes of making offers and administering and servicing them;
Banking institutions in the transfer of contributions and amounts;
Persons who provide accounting, information or legal services and advice to us, and other service providers and business partners with whom we conduct our business and provide our services;
Regulatory, governmental and judicial authorities that have the authority under statute to require the provision of information, including personal data, such as - courts, prosecutors, various regulatory authorities such as the Consumer Protection Commission, the Data Protection Commission, authorities with powers to protect national security and public order.

Personal data is provided, processed jointly with other persons and shared on condition that the relevant person, our contractor, ensures that it processes the personal data received from us in accordance with the requirements of the legislation, subject to the necessary and appropriate technical and organisational measures to ensure adequate protection of the personal data received from us.

Please be advised that our website may contain links to other such websites that are not owned and operated by us. We cannot control and are not responsible for the personal data processing practices or the content of these other pages.

We strongly encourage you to review the privacy policies and information of each website that collects and to which you submit personal data.

In all cases, we enter into contracts with the individuals with whom we work and to whom we provide your personal data, requiring them to take the necessary steps to ensure that your personal information is protected. We will only transfer to these contractors the information they need to provide us with the agreed services, without allowing them to use your information for their own purposes.

We will not provide your personal information to third parties to send you unsolicited marketing communications unless you have given the necessary consent to do so. In the event that you receive unsolicited marketing communications from persons with whom we do business, please notify us at the following email address:

YOUR RIGHTS AS A DATA SUBJECT

As a data subject, you have a number of rights granted by Bulgarian and European legislation.

Some of these rights may only arise or be exercised on certain grounds for processing your personal data, while others may be limited or excluded by law. If you have any questions regarding the exercise of your rights as a data subject, you can ask them at and we will respond at the earliest opportunity.

Under current legislation, you have the following rights:

The right to access your personal data, to obtain confirmation as to whether we are processing your personal data and what personal data, for what purpose and on what basis it is processed, to whom it is provided, for how long it is stored.

You can obtain a copy of the personal data being processed. We may charge an administration fee for additional copies. The exercise of the right of access should not adversely affect the rights or freedoms of others.

- Right to request rectification or completion of inaccurate personal data
- Right to request erasure of personal data (right to be forgotten) - where any of the following grounds apply - the data is no longer necessary for the purposes for which it was collected, you withdraw your consent (where processing is based on consent and there is no other legal basis) or object and there is no other legal basis, the data is being processed unlawfully, the data must be erased in order for us to comply with a legal obligation, the right to request restriction of the processing of your personal data

This can be exercised if - you contest the accuracy of the personal data; the processing is unlawful but you do not want the data to be erased, only to restrict its use; we no longer need the personal data for the purposes for which it was collected but you require it for the establishment, exercise or defence of legal claims; you have objected to the processing of the data on the grounds of the performance of a task carried out in the public interest or for the purposes of our legitimate interests.

Where the processing of your personal data has been restricted, we may still continue to process it in two cases - with your explicit consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural person or for important reasons of public interest for the Union or a Member State.

Right to object to the processing of your personal data, including for direct marketing purposes

If you have objected to the processing of personal data necessary for the performance of a task carried out in the public interest or for the purposes of our or a third party's legitimate interests, or profiling, we may continue to process it if we can demonstrate that there are compelling legitimate grounds for doing so which override your interests, rights and freedoms, or are relevant for the establishment, exercise or defence of legal claims.

Where your personal data is processed and used for direct marketing purposes, you may object to this and we will stop processing and using it for these purposes.

Right to data portability

You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format, and to transfer that data to another controller without us preventing you, provided that we process the data in an automated way and the processing is based on consent provided by you or is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into a contract.

- The right to receive information about the actions carried out by the Company in connection with the exercise of the above rights
- The right to lodge a complaint with the competent public authority
- The right to withdraw your consent at any time where processing is based on consent given by you, provided that this does not affect the lawfulness of processing based on consent before it is withdrawn.

We would process and respond to your questions and requests and assist you in exercising your rights free of charge. If the requests are manifestly unfounded or excessive, particularly due to their repetitiveness, we have the right to charge a reasonable fee or refuse to act on the request.

We would respond to you within one month of receipt of the request to exercise rights as to whether there are lawful grounds for granting the request and what action we would take in this regard. If assistance or clarification from you is required, we would notify you of this. If necessary, given the number and complexity of the requests, the time limit may be extended by a further two months, which we would notify you of.

We inform you that we do not carry out automated decision-making for our customers as a result of automated processing of their personal data.

To exercise your rights, write to us with your request at the email or postal address below. The request may be made in person or through an authorized person and in a manner that unambiguously establishes your identity and allows us to identify you as the subject of our processing, e.g. by writing to us from the e-mail address you have provided for contacting you. Where we are in doubt about the identity of the person making the request to us, we may request further information to confirm their identity. If we do not receive such information and are unable to identify the data subject, we may refuse to act on the basis of the request made.