Privacy Policy

PRIVACY POLICY AND PERSONAL DATA PROTECTION OF "DELUXE PROPERTIES" LTD.

With this Privacy and Personal Data Protection Policy, Deluxe Properties Ltd. takes into account the privacy of the individual and makes efforts to protect the personal data of individuals against unlawful processing. The administrator has taken the necessary technical and organizational measures to protect the personal data of individuals who use the services offered by the company. With this policy, the company aims to acquaint the data subjects with the rights and measures for the collection of certain categories of personal data necessary for the full provision of the services we offer.

I. GENERAL INFORMATION 

1. Information about the data controller:

"DELUXE PROPERTIES" LTD 

UIC: 205102452

Headquarters and address of management: Sofia, Lozenets District, P.O. Box 1421, Lozenets District, 1421 Lozenets Blvd. "Arsenalski" No 121, ground floor

Contact person: Lachezar Georgiev

e-mail address: l.georgiev@deluxe.properties

web page: www.deluxe.properties

*Further down in this Privacy and Personal Data Protection Policy, Deluxe Properties Ltd. will be referred to as the "Company" or the "Administrator".

 The company performs intermediation in the sale, rental of real estate, preparation and presentation of expert valuations, market research and financial analysis. 

The Company is a personal data controller within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR) and the Personal Data Protection Act (PDPA).

2. Objectives and scope of the Policy

With this Privacy and Personal Data Protection Policy, the Company aims to inform individuals about: 

• the purposes and means of the processing of personal data; 
• the grounds for the processing of personal data (the mandatory or voluntary nature of the provision of the data), as well as the consequences of refusal to provide them;
• the recipients or categories of recipients to whom the data may be disclosed; 
• information on the right of access, the right to rectification and deletion of the collected data.
• the technical and organizational measures taken to protect the personal data provided for processing.

3. Terms and definitions:

Personal data means any information relating to an identified or identifiable natural person ("data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. 

"Special categories of personal data" – personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the unique identification of a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation.

Processing is any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Controller or controller responsible for the processing is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

5. "Joint Controllers" – when two or more Controllers jointly determine the purposes and means of personal data processing, they are joint Controllers.

Processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

'Register' means any structured set of personal data accessed according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis;

8. "Data subject" – any living natural person who is the subject of personal data stored by the Administrator.

Consent of the data subject is any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

10. "Child" – The General Regulation defines a child as anyone under the age of 16. The processing of personal data of a child is legal only if a parent or guardian has given consent. The controller shall make reasonable efforts to verify, in such cases, that the holder of parental responsibility for the child has given or is authorised to give his or her consent.

Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

"Personal data breach" – a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed.

13. "Main place of establishment" – the headquarters of the Administrator in the EU will be the place where he takes the main decisions about the purpose and means of his data processing activities. With regard to the processor, its main establishment in the EU will be its administrative centre. If the Controller is based outside the EU, it must appoint a representative in the jurisdiction in which the Controller operates in order to act on behalf of the Controller and deal with supervisory authorities.

Recipient is a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; The processing of those data by those public authorities shall comply with the applicable data protection rules according to the purposes of the processing.