PERSONAL DATA COLLECTION AND PROTECTION POLICY

GENERAL INFORMATION

As a personal data controller, LEONARDO OOD performs its activity in accordance with the Personal Data Protection Act and Regulation (EC) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data.

Information on Personal Data Controller

Name and legal form: LEONARDO OOD, Uniform Identification Code: 813147912

Registered office and address of management: 7 Krastyu Mirski Str., 3rd floor, office No. 7, 9000 Varna

E-mail: info@leonardo.bg ;  Contact person Gulielmo Paron

HANDLING PERSONAL DATA. OBJECTIVES AND PRINCIPLES.

We use the data and personal information provided by our clients in connection with our activities, including: in order to fulfill our obligations as a party to a contract for the sale of goods or services, order management, preparation of any documents in this connection, delivery of goods and services, processing payments, keeping accounts in connection with the execution of contracts to which we are a party, communicating with clients about orders, products, services, including upon an express consent, which may be withdrawn at any time - to send newsletters and advertising messages.

Also, LEONARDO OOD uses this data and information to improve the online store and online trading platform in order to avoid or prevent fraud or abuse to the detriment of the website as well as to allow third parties to provide technical support, logistics and other website services.

For the processing and storage of personal data, LEONARDO OOD may process and store personal data in order to protect its legitimate interests as following:  

• fulfilling its obligations to the National Revenue Agency, the Ministry of Interior and other state and municipal authorities.

LEONARDO OOD complies with the following principles when processing your personal data:

• legitimacy, good faith and transparency;
• limitation of processing objectives; 
• relevance to processing objectives and minimization of collected data;
• accuracy and timeliness of the data;
• restriction of storage in order to achieve the objectives;
• integrity and confidentiality of processing and ensuring an adequate level of security of personal data;

LEONARDO OOD takes precautions that include administrative, technical, and physical measures to protect your personal data from loss, theft and misuse, as well as from unauthorized access, disclosure, alteration or destruction.

WHAT PERSONAL DATA WE COLLECT AND PROCESS

Information provided by the user

When you sign up for a user account, buy goods, participate in lottery, etc., we can collect different types of information, including but not limited to name, postal address, telephone number, email, etc. In cases where certain documents, such as invoices, need to be issued, additional data may be required in accordance with regulatory requirements.

Information collected automatically from the website

A series of data is collected in an automated module from the website, such as the Internet Protocol (IP) address used to connect the computer to the Internet; information about your computer, and connection methods, such as the type of browser and operating system version. Also, the website may use browser data such as cookies, Flash cookies, or similar data.

When you visit the website and use our products, the website may place a cookie in your web browser. A cookie module is a low amount of stored information on the computer in order to identify the browser while interacting with websites. Cookie modules can be used to store items such as identifiers or user preferences.  

You can configure the browser to access all cookie modules, or to reject all cookie modules. Browsers are different from each other and therefore we ask that you contact the browser's Help menu to learn how to change the cookies.

By registering on the website / ordering and completing forms with personal data, users declare that they agree that all their personal data should be included in LEONARDO OOD database and give their explicit and unambiguous consent that their personal data may be stored and processed by LEONARDO OOD.

CATEGORIES OF PERSONAL DATA RECIPIENTS OUTSIDE THE COMPANY

LEONARDO OOD may provide the above personal data to third parties, in certain cases, in order to fulfill our obligations under contracts or legal agreements entered into with you, whereby it is necessary or we will be required to disclose personal data provided by you to our partners (e.g., transport, courier, financial institutions, etc.) or to competent authorities, including:

• Public authorities, when identifying the need to provide the data;
• Processors of personal data under a contract: IT companies maintaining a website, companies providing accounting and legal services;
• Providing information to the court and third parties in court proceedings, in accordance with the requirements of procedural and substantive legal acts applicable to the proceedings;
• In cases of compliance with statutory obligations.

The data will not be transferred to third countries outside the European Union.  

WHEN WE DELETE YOUR PERSONAL DATA

Personal data retention period

We shall store your personal data for no longer than the duration of your user account on our website. Upon expiration of this period, we take the necessary care to erase and destroy all your data without undue delay. We shall notify you, if the data retention period is to be extended in order to meet the objectives, performance of the contract, in view of the legitimate interests of LEONARDO OOD or else. We store the personal data that we need to keep under the applicable law for the applicable term, which may exceed the duration of your account registration.

Please keep in mind that we will not delete or anonymize your personal data, if it is necessary for pending court, administrative proceedings or proceedings to handle a complaint filed by you.

Your data can also be anonymized. Anonymisation is an alternative to data erasure, where all personal identifiable elements, elements that allow you to be identified, shall be irretrievably deleted. For anonymized data there is no legal obligation for deletion because it does not constitute personal data.

YOUR RIGHTS RELATING TO PERSONAL DATA PROCESSING

Withdrawal of consent for processing of your personal data

If you do not want all or any of your personal data to continue to be processed by LEONARDO OOD for any or all processing purposes, you may at any time withdraw your consent to processing through a free text request. LEONARDO OOD may request that you verify your identity and the identity of the person to whom the data relate. By withdrawing the consent to process personal data that is required to create and maintain your registration for service usage, your user account will become inactive. Withdrawal of consent does not affect the lawfulness of the processing of the data of the person based on the consent given by the person before it is withdrawn and the processing based on another legal basis;  

Right to information:

You have the right to request:

• information about whether data relating to you are being processed, information for the purposes of such processing, the categories of data, and the recipients or categories of recipients to whom the data is disclosed;
• a message in an understandable form that contains your personal data being processed, as well as any available information about its source;
• information about the logic of any automated processing of personal data relating to you, at least in the case of automated solutions;

Right to access

You are entitled to receive from LEONARDO OOD a confirmation whether personal data associated with you is being processed. You have the right to access the data relating to you as well as the information relating to the collection, processing and storage of your personal data. LEONARDO OOD shall provide you with a copy of the processed personal data relating to you on request in electronic or other appropriate form.

Right to data rectification:

When you feel that your personal data is inaccurate or incomplete, you can request that it be changed accordingly.

Right to data deletion („to be forgotten“)

You have the right to request from LEONARDO OOD to delete your personal data without undue delay, and we, LEONARDO OOD have an obligation to delete them without undue delay when one of the following reasons exists:

• personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
• you withdraw your consent on which the processing of the data is based and there is no other legal basis for the processing;
• if you object to the processing of your personal data relating to you and there are no legitimate grounds for processing that give an advantage;
• your personal data has been processed illegitimately;
• the personal data must be deleted to comply with a legal obligation under EU law or the law of EU member country applicable to LEONARDO Ltd .;
• the personal data have been collected in connection with the provision of information society services.

LEONARDO OOD is not obliged to delete personal data, if it collects and processes it:

• for the exercise of the right to freedom of expression and the right to information;
• to comply with a legal obligation that requires processing provided by EU law or the law of EU member country applicable to LEONARDO OOD or for the performance of a task in the public interest or in the exercise of the official powers conferred on LEONARDO Ltd.;
• for reasons of public interest in the field of public health;
• for purposes of archiving in the public interest, for scientific or historical research or for statistical purposes;
• for the establishment, exercise or protection of legal claims.

In order to exercise your right to be "forgotten" you should submit a request electronically or in writing sent to LEONARDO OOD as well as to certify your identity and the identity of the person to whom the data relate to LEONARDO OOD by presenting your identity card on the premises for identification purposes and, if necessary, enter your login details to the account of person to whom the data relate to an employee of LEONARDO OOD.

LEONARDO OOD shall not delete the data for which there it has a legal obligation to store, including for under against claims brought against the company or for proving its rights.

Right to objection:

You may at any time object to the processing of personal data by LEONARDO OOD that apply to you, including processing for the purposes of profiling or direct marketing purposes.

Right to restrict data processing:

You have the right to request from LEONARDO OOD restriction of processing if:

• you question the accuracy of the data for the period we must verify its accuracy; or
• the processing of the data is without legal basis, but instead of deleting it, you want their processing to be restricted; or
• we no longer need these data (for the intended purpose), but you need them for the establishment, exercise or protection of legal claims; or
• you have filed an objection to the processing of the data, pending verification whether the reasons of the data controller are legal.

When you have requested restriction of processing according to the above-mentioned reasons LEONARDO OOD will inform you before revoking the restriction of processing.

Right to data portability:

You may ask us to provide the personal data you have entrusted to our care in an organized, orderly, structured, generally accepted electronic format if:

• we process the data under contract and
• processing is done automatically

Right to file a complaint:

If you believe that we are violating the applicable legal framework, please contact us to clarify the matter.  

Applications for access to information or for rectification are filed in person or by an explicitly authorized person by a notarized power of attorney. An application may also be made electronically, in accordance with the Electronic Document and Electronic Signature Act.

We will rule on your request within 14 days of its filing. If it is objectively necessary for a longer period - in order to collect all the requested data and this seriously impedes our activity, this period may be extended to 30 days. By our decision we give or deny access and/or the information requested by the applicant, but we always motivate our response.

If you have any questions about the Personal Data Collection and Protection Policy, you can contact  Gulielmo Paron; е-mail: info@leonardo.bg