««

PRIVACY STATEMENT

 

I. About the Personal Data Administrator:

A Personal Data Administrator within the meaning of the General Data Protection Regulation (GDPR) (Regulation 679/2016), hereinafter referred to asthe ‘Regulation’, in the EU Member States as well as under other provisions of domestic law is:

LIGHTHOUSE GOLF AND SPA HOTEL AD, UIC 201667372

Bulgaria

Address: Sofia, Vazrazhdane region, 55A Stamboliyski blvd., floor 3, office 5

Email: info@lighthousegolfresort.com

Phone: (+359) 0700 20 366

Website: http://www.lighthousegolfresort.com/

II. Contact with the Data Protection Officer (DPO)

If you have any questions regarding your personal data processing or wish to exercise your rights as a data subject under the Regulation, please contact the Data Protection Officer of the Company at:

Name: Damian Todorov

Address: city of Stara Zagora, 57 Slavyansky Blvd.

Email: dpo@liqhthouseqolfresort.com

III. General Information on Personal Data Processing

1. Scope of personal data processing

In the field of tourism and the providing of travel services, personal data processing  is needed as to fulfil the legal obligations of the parties in legal relations, and the proper and full implementation of the services we offer and the subject of the contracts we conclude. Without these personal data, LIGHTHOUSE GOLF AND SPA HOTEL AD could not secure a full, quality and lawful performance of their duties and to protect the interests of data subjects.

2. Objectives and grounds for processing:

2.1. We declare that the collected personal data will only be used for the following purposes:

  • Pre-contractual and ongoing identification;
  • Implementation of rights and obligations under and in connection with a contract;
  • Settlement of disputes - extrajudicial and judicial;
  • Marketing purposes (in case you have given your explicit permission to do so);
  • Prevention and enforcement of measures against terrorist financing and "money laundering";
  • Statistics, reports and references relating to the specific contract;
  • Prevention of fraud and embezzle of personal data;
  • Legal obligations for the submission of data to supervisory, judicial, regulatory, state and local authorities and institutions;
  • Administrative services for the above-mentioned purposes;

LIGHTHOUSE GOLF AND SPA HOTEL AD does not carry out processes of automated decision making, including profiling, which, under the Regulation consists of all forms of automated processing of personal data to evaluate personal aspects relating to an individual, particularly analysing or prognosis of a various aspects related to the results in the subjects’ job data, economic condition, health, personal preferences or interests, reliability or demeanour, location or movements when it has legal effects on the individual or affects it equally.

If it is required to use your personal data for a new purpose that is not covered by this Privacy Statement, we will present a new one to you and, if necessary, will demand your prior consent for the new processing.

2.2. Grounds for Processing:

  • If we obtain the data subject's consent with respect to some of the above objectives, then Art. 6 (1) (a) of the Regulation entitles us to process the specified data;
  • When processing personal data that is necessary to complete a contract in which the person concerned is a party to the contract. The Company acts on a contractual basis for this - under Art. 6 (1) (b) of the Regulation.
  • If it is necessary to process personal data in order to fulfil a statutory obligation, to which our company is subject - Art. 6 (1) (c) of the Regulation;
  • If the vital interests of the person concerned or of another individual require the personal data processing - Art. 6 (1) (d) of the Regulation;
  • If processing is necessary for the performance of a task of public interest or in the exercise of official powers conferred to the personal data administrator - Art. 6 (1) (e) of the Regulation;
  • If the processing is necessary for the legitimate interests of the personal data administrator or a third party, except where priority over such interests is taken by the interests and rights and freedoms of the data subject, more particularly where the data subject is a child - Art. 6, (1) (f) of the Regulation;

IV. Which Personal Data We Collect and Use

In view of the Regulation, as a Personal Data Administrator, we process only the personal data required for the purposes set out in Section III, as follows

1. “General” or “ordinary” category of personal data we process:

  • Name, middle name, surname;
  • PIN, Foreigner’s identification number or other official and universal identifier (passport number, identity card number, etc.);
  • Nationality;
  • Permanent, current address, communication address;
  • Email;
  • Phone number ;
  • Vehicle registration data;
  • Marital status
  • Data relating to the exercise of rights of the data subject;
  • IP address
  • Credit/debit card details.

2.  "Special" or "Sensitive" category of personal data:

  • Health status data;
  • Eating regimens

In case of processing of "Special" or "Sensitive" data, explicit consent from the data subject is required.

V. Sources of Information

In the collection of personal data, the Personal Data Administrator uses the following sources:

  • Publicly available sources of information;
  • Information provided personally by the data subject on a physical carrier or presented orally, in writing or electronically;
  • Provided information under a contract with another Personal Data Administrator, in our capacity as Processor;

VI. Organizations/Individuals Who Are Possible to Receive Your Personal Data

In certain cases, in order to achieve the objectives listed in Section III, we may need to provide your personal data to:

1. State and local authorities and institutions - NRA, MI, CPDP, FSC, court, prosecutor's office, investigative authorities, municipal offices, etc.;

2. External experts involved in servicing and/or implementing rights and obligations under your signed contract;

3. All authorized employees of LIGHTHOUSE GOLF AND SPA HOTEL AD, who are in a position allowing the processing of personal data;

4. All organizations and individuals who need the information provided to achieve the contractual objectives;

All third parties who may receive your data in certain cases will be specifically required to keep and process the data in accordance with the requirements of the Regulation and, where applicable, the Personal Data Protection Act and the secondary legislation.

The company declares that it does not intend to provide your personal data to third parties outside the EU. In the event of a need for such provision, the same will be done in accordance with the requirements of the Regulation, subject to all safety measures and procedures approved in the Company.

VII. Period of Data Storage

LIGHTHOUSE GOLF AND SPA HOTEL AD will store your personal data no more than the statutory or contractual term, but not more than 5 years in the absence of the statutory terms, and the data will be stored in compliance with all the requirements of the Regulation. You can read more about how we will use and store your personal information on our website: http://www.lighthousegolfresort.com/ link to the document section where you will find the Privacy Policy of the Company in which the process and conditions for use and storage of personal data are described, as well as the Informational messages under art. 13 and art. 14 of the Regulation.

VIII. Your Rights As a Data Subject

At any time while processing your personal information, you have the following rights:

  • you have the right to request a copy of your personal data from LIGHTHOUSE GOLF AND SPA HOTEL AD and a right of access at any time to your personal data;
  • You have the right to request from LIGHTHOUSE GOLF AND SPA HOTEL AD your personal data in a form convenient to transfer to another personal data administrator or request that we do so without being hindered by our part;
  • You have the right to request from LIGHTHOUSE GOLF AND SPA HOTEL AD to correct without unnecessary delay your inaccurate personal data as well as data that are not current;
  • You have the right to request from LIGHTHOUSE GOLF AND SPA HOTEL AD to delete your personal data without unnecessary delay for any of the following reasons: 
    • personal data are no longer needed for the purposes for which they were collected;
    • when you have withdrawn your consent;
    • when you have objected to the processing;
    • when processing is unlawful;
    • when personal data must be erased in order to comply with a legal obligation under EU law or the law of a Member State that applies to us as a Personal Data Administrator;
    • when personal data were gathered in connection with the provision of services to the informational society.

We may refuse to erase your personal information for the following reasons:

    • in the exercise of the right to expression freedom and the right of information;
    • to comply with a legal obligation on our part or to carry out a task in public interest,
    • for reasons of public interest in the field of public health;
    • for purposes of archiving in the public interest, for scientific or historical research or  for statistical purposes, in so far as deletion is likely to render impossible or seriously obstructing the achievement of the purposes of such processing; or for the establishment, exercise or protection of legal claims.
  • you have the right to request from LIGHTHOUSE GOLF AND SPA HOTEL AD to restrict your personal data processing, in which case the data will only be stored but not processed. Our refusal to restrict will be explicit only in writing, and we are obliged to reconcile it with a legitimate reason;
  • you have the right to withdraw your consent of your personal data processing at any time with a separate request addressed to the administrator;
  • you have the right to object to certain types of processing as direct marketing (unsolicited advertising messages);
  • you have the right to object to an automated processing, including profiling;
  • you have the right not to be the subject of a decision based solely on automated processing including profiling;
  • If we need to use your personal data for a new purpose not covered by this Privacy Statement, we will provide you with a new data protection notice and when and where necessary we will require your prior consent for the new processing. 

All the above requests will be forwarded if there is a third party (recipients, including outside the EU and international organizations) in your personal data processing.

Exercise of the data subject's rights

At any time you wish to exercise any of the above rights (Art. 15-22 of the Regulation), you should contact the Data Protection Officer through the above contacts and send an Application regarding your request as a data subject.

In accordance with the requirements of the Regulation, upon your request as a data subject, the administrator shall assist without unnecessary delay and in any case within 1 month of receipt of the request. It is possible:

  • If necessary, this period may be extended by a further 2 months, taking into consideration the complexity and the number of requests. The administrator shall inform the data subject of any such extension within one month of request receipt, indicating the reasons for the delay.
  • When the data subject submits a request by electronic means (via e-mail and other), the information is provided, if possible, by electronic means (by electronic mail and other) unless the data subject has requested otherwise.

If the Personal Data Administrator fails to act on the data subject's request, the Personal Data Administrator shall notify the data subject without delay and at the latest within one month of receipt of the request about:

  • reasons not to take actions, and
  • the possibility of lodging a complaint with a supervisory authority
  • and seeking legal protection.

The information referred to in Articles 13 and 14 of the Regulation and any communication and action under Articles 15 to 22 and 34 of the Regulation shall be made available free of charge. Where the claims of a data subject are manifestly unfounded or excessive, in particular because of their repeatability, the Personal Data Administrator may either:

a) to impose a reasonable fee, taking into consideration the administrative costs of providing information or communication or undertaking the requested action, or
 
b) refuse to take any actions on the request.

The administrator bears the burden of proving the manifestly unfounded or excessive nature of the request.

Without prejudice to Article 11 of the Regulation, where the Personal Data Administrator has reasonable concerns as to the identity of the individual submitting a request under Articles 15 to 21 of the Regulation, the Personal Data Administrator may request the provision of additional information necessary to verify the identity of the data subject. In such cases, we may ask you to certify your identity through a document or other unequivocal way.

Lodging a Complaint with the Supervisory Authority

You have the right to lodge a complaint directly to the supervisory authority, as the supervisory authority responsible for it is

Commission for Personal Data Protection

address: Sofia 1592, 2, Prof. Tsvetan Lazarov Blvd. (www.cpdp.bg).

Lodging a Complaint with the Personal Data Administrator

In case you wish to lodge a complaint about your personal data processing through LIGHTHOUSE GOLF AND SPA HOTEL AD, you can do so at the contact details of LIGHTHOUSE GOLF AND SPA HOTEL AD or directly to the Data Protection Officer (the contact details are listed above).

You can read more about how and why we use your data here: http://www.liahthouseaolfresort.com/ba/politika-za-zashtita-na-lichnite-danni

 

Privacy Statement

For the operation of its website (http://www.lighthousegolfresort.com/) LIGHTHOUSE GOLF AND SPA HOTEL AD processes personal data for individuals for the purpose of informing and presenting its services in the field of tourism. In the process of its activity LIGHTHOUSE GOLF AND SPA HOTEL AD acts in its capacity of a Personal Data Administrator by processing personal data of individuals as data subjects under the General Data Protection Regulation (GDRP) - Regulation (EU) 2016/679 and the Bulgarian legislation on personal data.

PERSONAL DATA PROCESSING

What personal data we collect

When using the Website's functionalities on the part of the visitors (data subjects) as a Personal Data Administrator, LIGHTHOUSE GOLF AND SPA HOTEL AD processes the following types of personal data:

  • Cookies (browser identifiers);
  • IP address;
  • Two names;
  • E-mail address;
  • Phone number;
  • Country;
  • Arrival/departure information.

In the event of failure to provide some personal data or providing of incorrect personal data, it will be extremely difficult or impossible for the Personal Data Administrator to perform the necessary actions to satisfy the data subjects using of the website functionality including answering inquiries, communications on reservations, providing additional information, and more.

CONDITIONS FOR USE OF COOKIES

In order to provide personalized and adequate services through our website and our products, LIGHTHOUSE GOLF AND SPA HOTEL AD needs a technology to store and save information about their use by you using the so-called “cookies”. They represent small text files that contain small amounts of information and are stored on your computer or in the memory of your web browser. Then your web browser sends these cookies back to our website every next visit by helping the website to recognize you and store your user information preferences (visits, clicks, activity history). Using cookies collected is very limited and involves technical objectives - improving and customizing the functionality of our website and our products.) The information gathered through the use of cookies can not be associated with a particular person. The cookie storage period is 5 years according to the international NAI standards that you can see at https: //www.networkadvertising.org/.

More detailed information about cookies and their functionality can be found at https://www.aboutcookies.org/.

Visiting our site and registering for use of our products, you accept the use of cookies in the manner described in these Terms and Conditions of Cookies Use. Nevertheless, you can control and manage cookies in different ways. Take into consideration, that removing or blocking cookies may affect the use of our website and our products by limiting your access to certain features or parts of them.

Types of cookies we use:

  • Strictly Nessecary Cookies

These cookies make it possible for our website and our products to function properly, as they allow you to view the information in them and use their functions. For example, thanks to them we show you the information on our website in the correct language and more.

  • Performance Cookies

These cookies allow us to tailor the work of our site and our products to the preferences of our visitors and users in order to use their full functionality, watch the videos in it, and more similar. This information is entirely anonymous, used for very limited purposes and is kept for a limited period of time.

  • Analytical Cookies

We use analytical tools that enable us to understand the attendance of our site, whether it is easy for our users to work with it and what interests them in its content. The information gathered through these cookies is used exclusively for statistical purposes and is not intended to be used for personally identifying users. We do not receive any information about your personal data. These cookies show us what pages of our site you've viewed, whether you've visited our site through a mobile or desktop device, and other anonymous data. Analytical tools are provided by Google Analytics and Adobe Analytics, and the information gathered for your IP address is not associated with any other information stored by Google and Adobe.

  • Precise Targeting Cookies

These cookies do not store personal information but only contain information about how you used our site. They can be triggered by our advertising partners to only show you information that is relevant to you. For example, cookies on Facebook, Google, and more.

 

Cookies management

 

You can control and manage cookies in different ways using your browser. Keep in mind that if you delete all cookies, the preferences you've saved will also be deleted. For more information on how to change your browser settings to block or filter cookies, visit https: //www.aboutcookies.org or http: //www.cookiecentral.com.

We use the following service providers and you can learn more about their privacy policies and how to opt out of their cookies by visiting their sites:

LIGHTHOUSE GOLF AND SPA HOTEL AD may, at its sole discretion, modify and supplement these Terms and Conditions of Cookies  Use at any time. In case of amendment of these Terms and Conditions, we will indicate the date of amendment and this amendment will enter into force with respect to you and your data after the date of this amendment or on another, explicitly stated later.

Purpose and Basis of Processing

As a Personal Data Administrator LIGHTHOUSE GOLF AND SPA HOTEL AD processes the listed types of personal data in the use of the website only for the purpose of providing up-to-date and adequate information about the activities of Lighthouse Golf Resort and the presentation of its services in the sphere of tourism and entertainment based on the fulfilment of its legitimate interest (Article 6 (1) (b) (e) of the GDRP).

Recipients of Personal Data

As a Personal Data Administrator, LIGHTHOUSE GOLF AND SPA HOTEL AD provides personal data of individuals to state institutions for the sole purpose of fulfilling a statutory obligation under Bulgarian and/or European legislation.

Sometimes we record some of information on our servers or send it to providers of informational service, third party, for more beneficial and accessible use of the functionalities of the website.

LIGHTHOUSE GOLF AND SPA HOTEL AD does not grant, sale, disclose or share any information (personal data within the meaning of the GDRP) about it’s website visitors with other persons or with unrelated companies except for the above-mentioned purposes of the following information service providers:

  • Google with its products: Google Analytics, Google Tag Manager, DoubleClick for Publishers, AdX, AdSense, Google Case, Google IMA, Google Plus: https://privacy.google.com/#, https://policies.google.com/technologies/partners- sites? hl = bg;
  • Facebook with relevant products: Facebook Tracking Pixel, Facebook Tools - Plug-in "like" button. Sign in with Facebook profile, etc. :https: //www.facebook.com/privacy/explanation;
  • Twitter: https: //twitter.com/en/privacy;
  • Cloudfare CDN (https://www.cloudflare.com/privacypolicy/)
  • Flickr https: //policies.yahoo.com/privacy/flickr/;
  • Tawk.to https://www.tawk.to/;
  • Clock Software https: //www.clock-software.com/company-aboutus/privacy-policy, html

Storage Period

As a Personal Data Administrator, LIGHTHOUSE GOLF AND SPA HOTEL AD stores the processed personal data within 2 years in order to provide quality services and constantly improve their quality.

Processing Security

As a Personal Data Administrator, LIGHTHOUSE GOLF AND SPA HOTEL AD undertakes various and numerous organizational and technical measures to maintain a high level of security of the processed individuals’ personal data according to the requirements of the GDRP and the Bulgarian legislation in the sphere of personal data protection.

Rights of Individuals (Data Subjects)

According to the requirements of GDRP, LIGHTHOUSE GOLF AND SPA HOTEL AD as a Personal Data Administrator notifies all individuals that in their capacity as a data subject they have the following rights in respect of their personal data to:

  • receive information on whether their personal data has being processed and get access to the data;
  • request that inaccurate personal data relating to them to be corrected;
  • request the deletion of related personal data in specific cases;
  • request restriction on their personal data to be processing under certain conditions;
  • receive the personal data that concern them and are provided to LIGHTHOUSE GOLF AND SPA HOTEL AD by them in a suitable format;
  • object to the processing of their personal data under certain conditions;
  • object to a solution based solely on automated processing including profiling.

Please note that inquiries regarding the exercise of rights of data subjects within the meaning of Regulation (EC) 2016/679 sent by post or courier require additional identity verification.

Right to Lodge a Complaint With a Supervisory Authority

Any individual who believes that her/his rights in respect of his or her personal data are violated by LIGHTHOUSE GOLF AND SPA HOTEL AD has the right to lodge a complaint with

The Commission for Personal Data Protection

with address: Sofia 1592, 2 Prof. Tsvetan Lazarov str.

Internet address: https://www.cpdp.bg/

Contact details of the Personal Data Administrator 

LIGHTHOUSE GOLF AND SPA HOTEL AD, UIC 201667372 Bulgaria

Address: Sofia, Vazrazhdane region, 55 Stamboliyski Blvd., floor 3, office 5

Email: info@lighthousegolfresort.com

Phone: (+359) 0700 20 366

Website: http://www.lighthousegolfresort.com/

Contact details of the Data Protection Officer

Name: Damian Todorov

Address: Stara Zagora, 57 Slavyanski Blvd.

Email: dpo@lighthousegolfresort.com

Last updated: 23.07.2018

 

3.3.REQUEST_OF_DATA_SUBJECT.docx

Twitter Facebook Flickr