FOUNDATION “ACADEMY ROZA (The Foundation)” is a data controller within the meaning of the Personal Data Protection Act (PDPA) and Regulation (EU) 2016/679 of the European Parliament and of the Council (the Regulation). In this capacity, we are aware of the responsibility we bear towards the subjects whose personal data we process. This text aims to inform the latter about the purposes and legal bases for the processing of their personal data, the potential recipients of the data, the retention period for which the data are stored, and their rights in connection with this processing.

I. Data Controller:

FOUNDATION “ACADEMY ROZA” VAT ID 206832130 Varna, Dr. Stoyan Zlatarov Street 1A, Floor 5, Apartment 17 +359 896 741 738 info@academiarоza.com

II. Definition of Personal Data:

This is any information related to an identified natural person or a natural person who can be identified, directly or indirectly, based on this information, by an identifier such as a name, identification number, location data, online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person.

III. Individuals Whose Personal Data Are Processed:

Personal data is collected and processed for the following categories of individuals:

• Students voluntarily participating in the trainings and competitions announced by the Foundation.
• Parents/guardians/custodians of the aforementioned students.
• Teachers and individuals in the field of arts and culture who have entered into a cooperation agreement with the Foundation.
• Donors.
• Legal or authorized representatives of suppliers of goods and services.

IV. Categories of Personal Data Subject to Processing:

The Foundation strictly adheres to the principle of “data minimization,” processing only the categories of personal data necessary for achieving the stated purposes for which it was established and complying with applicable regulatory requirements. Specifically, the Foundation processes the following types of personal data:

• For students voluntarily participating in the competitions and trainings announced by the Foundation: three names, personal identification number (EGN), address, phone number, email, attended educational institution, photos and videos featuring the student, as well as data regarding the student’s health condition.
• For parents/guardians/custodians of the aforementioned students: three names, personal identification number (EGN), address, phone number, and email.
• For teachers and individuals in the field of arts and culture who have entered into a cooperation agreement with the Foundation: three names, personal identification number (EGN), address, phone number, email, and data regarding social security status.
• For donors: three names, email, phone number.
• For the legal or authorized representative of suppliers of goods and services: three names, email, phone number.

V. Purpose of Personal Data Processing:

The personal data of students voluntarily participating in the competitions and trainings announced by the Foundation are processed solely for the purposes of their participation in their conduct. The personal data of parents/guardians/custodians of the students are processed solely for the purposes of representing the underage students before the Foundation. The personal data of teachers and individuals in the field of arts and culture are processed solely for the purposes of concluding and executing cooperation agreements with these individuals, as well as for fulfilling the tax, accounting, and social security obligations of the Foundation. The personal data of donors are processed for the purposes of establishing contact with them and for the sake of complying with the tax and accounting obligations of the Foundation. The personal data of representatives of suppliers of goods and services are processed solely for the purposes of concluding and executing contracts with these individuals.

VI. Legal Bases for Personal Data Processing:

Personal data of the subjects are processed based on:

Explicit written consent provided by the subject for data processing. Concluded cooperation agreements with teachers and individuals in the field of culture and arts, as well as commercial contracts with suppliers of goods and services. Regulatory obligations of the administrator. Such obligations exist in the areas of tax, social security, accounting, and insurance legislation. Protection of the legitimate interests of the administrators. A similar legitimate interest could be the necessity of judicial protection of the administrator’s rights arising from concluded contracts. Protection of vital interests of data subjects.

VII. Recipients of Personal Data:

Data is provided to third parties in order to comply with legal obligations applied to the administrator. The Foundation has such obligations in the areas of tax, social security, and accounting legislation, as well as insurance legislation. Recipients of personal data include external accountants, the National Revenue Agency, licensed insurance companies and/or intermediaries. Data is provided in compliance with the respective legal obligations and during potential inspections conducted by the relevant supervisory authority.

Personal data of subjects could be disclosed, in rare cases, for the protection of their vital interests.

Personal data of subjects may be disclosed to third parties (such as judicial authorities) in connection with the protection of the legitimate interests of administrators that do not contradict the interests of the data subjects.

Personal data is not provided to recipients in third countries and/or international organizations.

VIII. Data Processing Period:

Personal data of data subjects are stored within the following timeframes:

Regarding students voluntarily participating in the competitions announced by the Foundation – until the end of the competition period. The personal data of students who have won a competition are stored for a period of 5 years from the date of the competition.
Regarding parents/guardians/custodians of the aforementioned students – until the end of the competition period. The personal data of parents/guardians/custodians of students who have won a competition are stored for a period of 5 years from the date of the competition.
Regarding teachers and individuals in the field of arts and culture who have entered into a cooperation agreement with the Foundation – within the applicable regulatory deadlines related to the tax, social security, and accounting obligations of the Foundation.
Regarding donors – within the applicable regulatory deadlines related to the tax and accounting obligations of the Foundation.
Regarding suppliers of goods and services – within the applicable regulatory deadlines related to the tax, social security, and accounting obligations of the Foundation.

In case of a legal dispute related to the existence or execution of a contract, data continue to be processed until its conclusion and the satisfaction of all claims.

Regardless of the above scenarios, the personal data of data subjects cease to be processed in case of withdrawal/refusal of representation authority by the respective individuals.

XIX. Rights of Data Subjects:

• Right of Access to Data. Data subjects have the right to receive confirmation from administrators whether their personal data is being processed and to be informed about the purposes of the processing, the categories of personal data being processed, the recipients to whom this data is disclosed, the storage period, the existence of the right to request correction, deletion, restriction of processing, or to object to the processing; the right to lodge a complaint with a supervisory authority, and the right to obtain a copy of the processed personal data.
• Right to Rectification. Data subjects have the right to request administrators to correct inaccuracies and complete incomplete personal data related to them.
• Right to Erasure. Data subjects have the right to request the erasure of personal data processed by administrators if this data is no longer necessary for the purposes for which it was collected or processed, if the processing is based on the legitimate interests of the administrators and there is no overriding legal basis for the processing, if the data is processed unlawfully, if personal data should be deleted to comply with the Union or Member State law applicable to the administrators. Administrators can object to the deletion request if processing is necessary for the right to freedom of expression and information, for compliance with a legal obligation, for the performance of a task carried out in the public interest or in the exercise of official authority, for reasons of public interest in the area of public health, for archival purposes in the public interest, for scientific or historical research purposes, or for statistical purposes, or for the establishment, exercise, or defense of legal claims.
• Right to Restriction of Processing. Data subjects can request administrators to restrict the processing of their data if they contest the accuracy of this data for the period needed for the administrators to verify its accuracy; if the processing is unlawful and the data subjects oppose erasure and request restriction instead; if the administrators no longer need the data, but the data subjects require it for the establishment, exercise, or defense of legal claims; if the data subjects have objected to processing pending the verification of whether the legitimate grounds of the administrators override those of the data subjects.
• Right to Data Portability. Data subjects have the right, if the processing is carried out by automated means, to receive their data from administrators in a structured, commonly used, and machine-readable format and to transmit the data to another administrator.
• Right to Object. Data subjects have the right to object to the processing of their data by administrators, where processing is based on the legitimate interests of the administrators, unless the administrators can demonstrate compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the data subjects, or for the establishment, exercise, or defense of legal claims.
• Right to Lodge a Complaint with a Supervisory Authority. Data subjects have the right to lodge a complaint with the Commission for Personal Data Protection against administrators regarding the protection of personal data provided for processing.

Contact Information for CPDP (Commission for Personal Data Protection):

Commission for Personal Data Protection Sofia 1592, Prof. Tsvetan Lazarov Blvd. No. 2 kzld@cpdp.bg

X. Provision of Personal Data as a Condition for Contract Conclusion or Participation in Foundation’s Organized Contests and Training:

The provision of personal data by the data subject is necessary and mandatory for their participation in a contest or training, or for entering into civil or commercial relationships with the Foundation.

XI. How Do We Ensure the Protection of Personal Data?

The Foundation processes personal data of the data subjects while adhering to the fundamental principles laid out in the Regulation and applicable national legislation. The administrator takes necessary technical and organizational measures to protect the provided personal data, ensuring an adequate level of protection that corresponds to the data and the impact in case of a breach of their protection.