Personal Data Privacy Policy

Administrator's details:
"BHeart" Ltd.
UIC 207498185
Bulgaria, Plovdiv, 26 Petko Karavelov str.
Phone:+359 889088844
e-mail: info@bheart.space

I. "BHeart" Ltd. is a personal data controller, meets all the requirements of the new General Data Protection Regulation (GDPR), adopted by the EU. The regulation aims to ensure the protection of data of individuals from all EU member states and to unify the regulations for their processing. The full name of the act is REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC. It will be referred to in this document as the Regulation, GDPR or GDPR for short. Its text in all European languages can be found here: GDPR. Настоящата декларация за поверителност влиза в сила на 25.05.2018г.

"BHeart" Ltd collects only the data of persons necessary for the performance of the service offered and keeps them responsibly and lawfully.

"B Heart" Ltd is the controller of your data as users of our services. B Hart Ltd acts as a processor in relation to the personal data you provide using our services.

II.Contact details of the Data Protection Officer.

The Data Protection Officer can be contacted at info@bheart.space or +359 889088844.
What types of personal data B Heart Ltd collects, processes and stores:
"Ordinary" personal data:
first and last name;
email;
phone number;
cookie ID.
What type of information sites collect: cookies

Our website https://bheart.space, uses cookies, without which no website could provide you with correct services. By visiting our site, you accept the use of cookies. Types of cookies we use:
Mandatory cookies: these cookies are necessary for the proper functioning of the website system, allowing us to maintain a logical session between your client browser (profile) and the server.
Analytical cookies: these cookies give us information about the number of visits to our website and thanks to them we can analyse whether our users find it easy to use and whether we have answered frequently asked questions (Google Analytics cookies). They do not give us any information about your personal data, but only show us whether you have viewed more than one page of our site, how many times you have visited certain pages, whether you are using a mobile or desktop device and other anonymous data. For Google Analytics, we also use IP anonymization using anonymizelp. The maximum period we keep analytics data in Google Analytics is 50 months.

Functional cookies These cookies allow us to provide you with a more personalised service (for example, saving your last search) and so that you can make the most of our site's features. They do not store your personal information. Precision targeting cookies These are dynamic cookies from Facebook, Google etc. We do not use such cookies, but if you click on the advertising messages on the site, they may be triggered by our advertising partners. They also do not store any personal information. It is within your power to make the settings on the cookies you receive from our site. To do this, log into the settings of the browser you are using and follow the instructions. Note that if you restrict certain types of cookies, you may also restrict the functionality of the site on your own device.
Purposes and principles of use of the personal data we collect:

Your personal data will be processed and stored by the Controller on the following grounds: your explicit consent to the processing of your personal data for the purposes and within the time limits set out in these rules, as well as to communicate and send information to him.

For the purpose of registration and invitation to online training, events, promotional campaign related to your training, etc.

Your personal data will be used by the Controller on the territory of the Republic of Bulgaria and will not be transferred to third parties, except to: the automated marketing platform MailPoet in order to send the newsletter; the company managing the respective plugin or social network that you decide to use yourself; and Google in order to perform web analysis. Only IP address and log information is provided to the latter for the purpose of carrying out the analysis.

Your personal data will be stored in accordance with the legal requirements for the protection of personal data in electronic format in the following electronic register maintained by the Controller: "B Heart" Ltd for no longer than the minimum period necessary for this purpose after your unsubscription.

Compliance with a legal obligation that applies to B Heart Ltd (please see selective information about this in the section on the grounds that entitle us to process your data). For the purposes of B Heart Ltd's legitimate (legitimate) interests. Express consent obtained from you as a customer.

If you are one of our employees:
In addition to the above-mentioned purposes (insofar as the performance of contracts with customers is carried out through you), also for the protection of your rights and our legitimate interests, as well as for the protection of your rights and legitimate interests, for the purposes of labour, tax and social security legislation (Labour Code, Social Security Code, Social Security Code) and for the purposes of contractual relations in the performance of your job description. The processing of your health data is necessary for the purposes of (preventive or) occupational medicine, as well as for the purposes of the Medical Expertise Act and the CSR Act (for sick pay, maternity insurance, etc.).
Основанията, които ни дават право да обработваме Вашите данни са:

The processing is necessary to comply with our legal obligation:
Under the VAT Code and the VAT Act for taxation purposes (when issuing invoices) Under the Civil Registration Act. Under the Electronic Document and Electronic Authentication Services Act (for payments via POS terminals). It is IMPORTANT to note that through virtual POS payment is directly to the bank, through the BORICA system. We do not process financial and banking information. This is done only by your bank and the BORICA system. In this sense, paying via a virtual POS terminal is no different than paying via a physical POS terminal. Under the Banking and Banking Act (in relation to payments and under the Anti-Money Laundering Act)

In addition to the aforementioned regulations, other related regulations are in force.

Processing of your data on the basis of registration or payment for a course or event, or a concluded contract.

Processing of your data on the basis of a request by telephone or other means of mass communication.

1. For statistical purposes.
2. to establish, exercise or defend legal claims;
3. When you entrust B Heart Ltd. with the processing of personal data of a third party for the use of a service, B Heart Ltd. acts as a processor of personal data.

Organizations/persons who may receive your personal data would be: courier services Speedy and Econt, our accounting firm (Accounting Act).

III. Processing principles.

We comply with the following principles when processing your data: lawfulness, fairness and transparency; limitation of the purposes of the processing; relevance to the purposes of the processing and minimisation of the data collected; accuracy and timeliness of the data; limitation of storage to achieve the purposes; integrity and confidentiality of processing and ensuring an appropriate level of security of personal data.

IV. Consensus:

By agreeing to accept this Privacy Policy (Notice of Confidential Treatment of Personal Data), you give us permission to process your personal data only for the purposes specified by us.
Consent is necessary for us to process your personal data, but it must be explicit.

You may withdraw your consent at any time by submitting a withdrawal request by clicking UNSUBSCRIBE at the bottom of the email you receive from us or using a free text email (letter).

V. Transfer of personal data to a country outside the EU, or to an international organisation
"B Heart" Ltd. informs you in case it intends to transfer some or all of your personal data to third countries or international organizations. We do not intend to transfer your personal data to third parties without first obtaining your consent, unless it is necessary for the purposes of the contract
VI. We do not sell your data to anyone!
"B Heart" Ltd may at its own discretion provide some or all of your personal data to the relevant department for the purposes of processing, subject to the requirements of Regulation (EU) 2016/679.
VII. Data retention period
("B Heart" Ltd) stores your personal data for the following periods:

Retention period of your personal data

(1) The controller stores your personal data for a period no longer than the existence of your account in the online store or until you withdraw your consent to processing. After deletion of your account or successful termination, the Controller shall take reasonable care to delete and destroy all your data without undue delay or to anonymize it (i.e. to put it in a form that does not reveal your identity).
(2) The Controller shall store your personal data provided in connection with online orders for a period of 5 years for the purpose of protecting the legal interests of the Controller in the event of legal or administrative disputes with users of the online store, and the accounting documents shall be kept for the relevant statutory period.
(3) The Controller shall notify you in the event that the data retention period needs to be extended in order to comply with a legal obligation or in view of the legitimate interests of the Controller or otherwise.
The Data Controller shall store the personal data of the legal representatives of its business partners for the duration of the contract, in order to comply with the legitimate interests and legal obligations of the Data Controller, which may exceed the duration of the contract.

PROCEDURE FOR DOCUMENT DESTRUCTION
OBJECTIVE: Destruction of expired records
SCOPE: Documents containing personal data
Personal data provided to "ADMINISTRATOR" for processing shall be stored until the purposes for which they are processed are fulfilled, but no later than the period provided for under the statutory period for their storage.
The archives are located on the premises of the "ADMINISTRATOR".
After the objectives have been achieved, the personal data shall be physically destroyed, depending on the medium on which it is stored, in the manner described below.

Destruction of documents and files containing personal data
Accounting and commercial information, as well as all other information and documents relevant for taxation and compulsory social security contributions shall be stored by the Administrator for the following periods:
Payroll - 50 years ;
Accounting records and financial statements - 10 years ;
Documents for tax and social security control - 5 years after the expiry of the limitation period for the repayment of the public debt to which they relate;
All other holders - 5 years;
After the expiry of their retention period, paper or technical media which are not subject to transfer to the National Archives Fund may be destroyed. After the expiry of the retention period, the data shall be destroyed as soon as possible by the means provided for depending on the medium on which they are stored.
The destruction of paper media is by means of a shredder type technique or by burning, in the case of a larger volume, and of the technical media - by erasing and deleting files from the company's computer and server devices.
After achieving the goals, the personal data is physically destroyed and ceases to exist, for which destruction protocols are duly drawn up.

For the purposes of these Internal Rules:
The data controller is "BHеart" Ltd , with UIC 207498185 Location. Plovdiv, Country. Plovdiv 4000, ul. Petko Karavelov 26, ; as actions on behalf of the administrator are carried out by the manager.
If the above terms are changed or amended, they shall be updated in a subsequent VERSION without notice.
Following the amendment, the newly adopted rules shall apply.
This procedure has been adopted and approved by Order No. 44 of the Manager of the "Personal Data Controller" is "BHеart" Ltd. effective from 09.04.2024.
The order has been brought to the attention of all employees.

VIII. Your rights are as follows:

At any time while we are storing or processing your personal data, you (in the terminology of the law, you are called the data subject) have the following rights: you have the right to request a copy of your personal data from BHеart Ltd and the right to access your personal data at any time; you have the right to request from (name of controller) your personal data in a form convenient for transfer to another data controller, or to request that we do so without being prevented by us; you have the right to ask the controller to rectify, without undue delay, inaccurate personal data about you and data that is no longer up to date; you have the right to ask BHеart Ltd to erase your personal data without undue delay on any of the following grounds: the personal data is no longer necessary for the purposes for which it was collected; where you have withdrawn your consent; where you have objected to processing where the processing is unlawful; where the personal data must be erased in order to comply with a legal obligation under EU or Member State law that applies to us as a data controller; where the personal data was collected in connection with the provision of information society services.
ВНИМАНИЕ: Можем да откажем да заличим личните Ви данни по следните причини:

1. to comply with a legal obligation on our part or to perform a task of public interest,

2. for public health reasons;

3. for archiving purposes in the public interest, scientific or historical research or statistical purposes, in so far as erasure is likely to render impossible or seriously impede the achievement of the purposes of such processing;

4. to establish, exercise or defend legal claims;
5. in the exercise of the right to freedom of expression and the right to information.

IX. You: have the right to ask BHeart Ltd to restrict the processing of your personal data, in which case the data will only be stored but not processed. Our refusal to restrict will only be explicitly in writing, and we are obliged to justify it with the lawful reason; you have the right to withdraw your consent to the processing of your personal data at any time by a separate request to the Controller; you have the right to object to certain types of processing, such as direct marketing (unsolicited communications); you have the right to object to automated processing, including profiling; you have the right not to be subject to a decision based solely on automated processing, if we need to use your personal data for a new purpose that is not covered by this data protection statement, we will provide you with a new data protection notice and, where and when necessary, require your prior consent to the new processing.
All of the above requests will be forwarded if there are third party (recipients, including non-EU and international organisations) processing your personal data.

Х. You have the right to lodge a complaint with the European Supervisory Authority
In the event of a violation of your rights under the above or applicable data protection law, you have the right to file a complaint with the Personal Data Protection Commission as follows: 1. Name. Headquarters and registered office. 2. "1592, Prof. 2. 2. 2. "Proff. 2. Telephone: 02 915 3 518 5. E-mail: kzld@government.bg, kzld@cpdp.bg 6. Website: www.cpdp.bg

If you wish to make a complaint about the processing of your personal data by BHeart Ltd third parties, including non-EU and international organisations), you can do so to the contact details of B Hart Ltd or directly to the Data Protection Officer at the above contacts.
You can exercise all your rights regarding the protection of your personal data using the forms attached to this information. Of course, these forms are optional and you may make your requests in any form that contains a statement to that effect and identifies you as the data holder.

ADDITIONAL INFORMATION TO the Privacy Policy
What is personal data?
Under the GDPR, personal data is defined as:
"Any information relating to an identified natural person or an identifiable natural person ("data subject"); an identifiable natural person is a person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;".
Similarly, individual data which, when aggregated together, may lead to the identification of a specific person also constitute personal data.
Personal data that have become anonymous in such a way that the person is no longer identified or no longer identifiable are no longer considered personal data. For data to be truly anonymised, anonymity must be irreversible. If they can be used to re-identify a person, they remain personal data and fall within the scope of the GDPR."

Why does BHeart Ltd collect and store personal data?
In order to provide services to you, it is necessary for us to collect personal data in order to perform a service provision. Your telephone number to contact you and/or a person you nominate, your e-mail address - to send you information on the service, newsletter, discounts and other useful information or delivery of products and services.
We ensure that the information we collect and use is necessary (necessary) to provide our service and is not intended to invade your privacy.
For the purpose of direct marketing.
For statistical purposes.
For shipping.

Will you forward and share my personal data with other organisations or individuals?
We do not sell your data to third parties, nor will we pass it on in order to gain any benefit.
„Би Харт” ЕООД може да предостави Вашите лични данни на наши поддоставчици на услуги, които са сключили договор с нас.
All third parties who may receive your data are obliged to keep your data secure and to use it only to fulfil their obligations to us. When they no longer need your data to fulfil these obligations, they will have detailed instructions for destroying it in accordance with the procedures established by BHeart Ltd .
Where we intend to transfer special (sensitive) personal data to a third party, we will only do so after we have obtained your consent (there will only be an exception if we are legally obliged to do otherwise).
Recipients of your data may also be public authorities to whom we provide it under specific and explicit legal obligations.

How will you store and protect my personal data that you collect?

"BHеart Ltd collects, stores and uses the information you provide in a way that is compatible with the requirements of the General Data Protection Regulation (GDPR). We will endeavour to keep the information accurate and up to date.
We will not retain information about you longer than reasonably necessary to fulfill the specific purposes for which it was collected and for which you are notified here.
Some of the retention periods depend on legal obligations to keep documents and information for certain minimum periods.

We have taken all reasonable technical and organisational measures to ensure that your data is protected from unauthorised access. We have an integrated system for information protection, namely personal access accounts, secure username and password logins and more:

1. Storage of data in restricted areas in locked cabinets and metal crates; 2. If data is stored on electronic media such as disks and flash drives, the latter should be stored in the manner specified in the preceding paragraphs;
2. Access to the room in which the servers on which the data are stored should be restricted;
3. Computers on which personal data is stored have adequate antivirus protection;

5 Personal data should not be stored on devices such as mobile phones, smartphones and tablets.

6. Employees use software to administer the company's business processes.

а. Authorization is required.

b. The software DOES NOT store any data locally on the employees' computers - all data is protected on superhosting.bg's servers. The software has been developed to the latest security standards, using encrypted communication channels to superhosting.bg servers and encrypted communication channels to all third party partners and/or software services (services).

c. Each employee shall have limited access only to the information necessary to perform his or her duties

7.Upon written and/or email request from a customer - all his/her data is deleted and/or anonymized from the system.

8. The customer agrees to provide the data by ticking the checkbox on the website upon registration.

Other details of the systems are company secrets that can only be disclosed to CPD staff for your security.

Can I find out what personal data you have and process about me?
"BHeart Ltd , at your request, is required to tell you what information we hold about you and how it is processed. In the event that we hold your personal data, you can request the following information: contact details of the organisation that processes or on whose behalf your data is processed. (In some cases this may be a representative in the EU). Contact details of the Official you can contact Purposes of the processing; Legal basis for the processing; Relevant categories of personal data being processed; Recipients or categories of recipients to whom the personal data has been or will be disclosed; Recipients in third countries or international organisations if there is a transfer of personal data to such, and the guarantees that data security with them will be at least at the EU level; Estimated period for which the personal data will be kept; Details of your rights to request rectification or erasure.

Information about your right to withdraw your consent at any time; Details of your right to complain to a European Supervisory Authority; Information about whether the provision of personal data is a mandatory or contractual requirement or a requirement necessary for entering into a contract, and whether you are obliged to provide personal data and the possible consequences of failing to provide such data. The source from which your personal data was collected, where it was not collected directly from you. Any details and information about the existence of automated decision-making, such as profiling, and any meaningful information about the underlying logic of these operations, as well as the meaning and expected consequences of this processing.

How can I access my data that has been processed?
You need to make a request to the contact details provided to ( BHeart Ltd ), or directly to the contact details provided to the Data Protection Officer.
In order to verify your identity, you need to authenticate your identity uniquely - ID documents, electronic card.

Location:
Country: ……………………………………………
Address: ……………………………………………….
Phone: ……………………………………………..
Email: …………………………………………….

You can contact our Data Protection Officer directly here:
Email: info@bheart.space

Phone:+359 889088844
Information and requests are processed free of charge.

CONSENT: By agreeing to the Privacy Statement regarding our Personal Data Processing Policy, you expressly consent to us processing your personal data for the purposes stated.