PRIVACY POLICY

The protection of individuals in relation to the processing of personal data is a fundamental right.
The principles and rules on the protection of natural persons with regard to the processing of
their personal data should respect their fundamental rights and freedoms, in particular
with the right to protection of their personal data.
Regulation (EU) 2016/679 aims to ensure the protection of individuals' data and
to harmonise regulations on their processing across all EU Member States.
The protection of personal data is of particular importance both for the Data Controller
data and the subjects whose personal data are processed.
„Profi Travel Center Ltd. processes personal information in accordance with the General
Data Protection Regulation / Regulation (EU) 2016/679. As Controller
we process personal data to the extent necessary for the purposes,
for which we collect them. We have taken the necessary technical and organisational measures to
protection of personal data entrusted to us.

The principles we follow when processing personal data are:

„Lawfulness, fairness and transparency“ - we process your data
lawfully, in good faith and in a transparent manner;
Where the processing of data is not based on law or a contractual relationship, it is necessary
the data subject has given his or her prior consent to the processing of his or her personal data
data for one or more specific purposes.
Processing is lawful where it is necessary for the performance of a contract under which
the data subject is a party, or to take steps at the request of the data subject
before the conclusion of a contract;
„Data minimisation“ - we only collect relevant, related and limited
to the extent necessary in relation to the purposes for which they are processed;
„Purpose limitation“ - we collect your data only for specific, explicit and
legitimate purposes and we do not further process them in a way that is incompatible with those purposes;
„Accuracy“ - we keep the data accurate and up-to-date;
„Storage Restriction“ - we store them in a form that allows
the identification of the data subject for a period no longer than is necessary for the purposes for which
which are processed;
„Integrity and confidentiality“ - we process your personal data in a way that
ensure an appropriate level of security, including protection against unauthorised or
unlawful access. We have taken appropriate technical and organisational measures against
accidental loss, destruction or damage
„Accountability“ - We are accountable and able to demonstrate compliance with the principles
in the processing of personal data.
Consent is necessary:
Where the processing of personal data is not a legal obligation or part of a contractual
the explicit consent of the data subject is required.
We process personal data where the data subject's consent is explicitly given to
one or more specific objectives, within a contract or written declaration, such as the request
for consent shall be presented in a manner that clearly distinguishes it from other matters in an understandable and
easily accessible form and use clear and simple language.
Where we ask for consent for special categories of personal data we will always
justify why and how this information will be used.
In case of refusal by the traveller to provide consent to the processing of personal data,
we will not be able to honour the agreements and implement the stated
Trip.

Withdrawal of consent

You may withdraw your consent at any time. Withdrawing consent is equally
easy as giving it.
Just contact us at the contact details provided.
Upon receipt of the request, we will cease processing the data for the purpose or
the purposes for which we originally took the consent, unless we are otherwise legally
reason to continue processing, which we will notify you of in due course.

Purposes of processing

• We collect and process personal data for the following purposes:
  sale of tourist trips;
• for the provision of tourist services;
• hotel accommodation services;
• to provide a service for the purchase of airline tickets;
•  for the performance of a contract or in the context of a pre-contractual relationship;
•  marketing purposes - only with explicit consent;
   information security;
•  perform tasks related to our business activities;
•  execution of contracts with courier companies;
•  sending information messages;
•  obligations provided for in the Accounting Act and the Tax and Social Security Procedure Code and other related regulations in connection with the keeping of proper and lawful accounting;
• Establishing the identity of the client to meet regulatory obligations;

Categories of individuals

We process personal data about the following categories of individuals:

• Employees ;
• customers - individuals

Types of personal data we process

• Physical identity data - name, SSN, address, identity documents, telephone number, e-mail address;
• In case of assistance in obtaining a visa - data required by the respective embassy, such as marital status, family relations, state of health, etc;
•  Other data, if necessary, is processed with the explicit consent of the client (data subject) in order to ensure the provision of the relevant service.

Special categories of personal data („sensitive data“)

We do not process data revealing racial or ethnic origin, political views,
religious or philosophical beliefs or trade union membership, genetic
data, biometric data, the sex life or sexual orientation of the individual
Face.

Sources from which we collect personal data

We obtain the data from the data subject or from a publicly available source. Where the data is not obtained from the data subject, we inform the data subject of the source.

Categories of recipients of personal data

The categories of recipients to whom we may provide personal data are:

• public authorities for which the right of access is provided for in a legal act;
• persons with whom we have a contract for the provision of tourist and other services;
• other countries in the event of a visa or emergency situation;
• the diplomatic representatives of the Republic of Bulgaria abroad in an emergency situation;

Cookies

In addition to the information that you yourself provide in the various forms, we inform you that the site www.profitravel.bg uses cookies. Cookies are small pieces of information that are stored on the user's computer or mobile device. They allow to „remember“ user actions or preferences when browsing the Internet. Most browsers support cookies, but users can set their browsers so that they are not remembered or are deleted at a certain point. We use cookies to track traffic to our site, to analyze how easy it is for you to use our site, and to help you avoid filling in the same information each time you visit our site. The information collected is processed by Profi Travel Centre Ltd for the sole purpose of providing the services you have requested, requests/orders you have placed and contacting you as our customer.

Storage period of personal data

We keep your personal data for no longer than is necessary for the purposes for which we process it.

Our retention period for contracts for travel services is 6 years from the date of their conclusion, together with the accompanying documents forming an integral part thereof;
The storage period for personal data when purchasing an air ticket is 3 years. After this period, we delete and destroy your data.

„Profi Travel Center Ltd. will notify you in the event that the data retention period needs to be extended in order to fulfill the purposes, perform a contract or for our legitimate interests.

„Profi Travel Center Ltd. stores the personal data that it is required to keep under applicable law for the relevant period provided, which may exceed the period of the purposes for which we process them.

Data security

We have put in place appropriate technical and organisational measures to prevent accidental loss or unauthorised access, alteration or disclosure of personal data. We have established and maintain a Data Protection System. Authorised employees process personal data only on the basis of our instructions and in accordance with our duty of confidentiality. In the event of a personal data breach, we will immediately implement the procedures set out in the Data Protection System.

Rights of the data subject

We will provide you, upon request, with any information that relates to
the processing of data in a concise, transparent, comprehensible and easily accessible form, in a clear
and simple language.
Your rights in the processing and storage of your personal data are:

• Right to information and access
• Right to correction of data
• Right to erasure
• Right to restriction of data processing
• Right to data portability
• Right to object
• Right to lodge a complaint with the supervisory authority

In the event of a breach of your rights under data protection legislation, you have the right to lodge a complaint with the supervisory authority:

Commission for Personal Data Protection (CPDP)
Registered office and management address:
gr. 1592 Sofia Blvd. „Proff. Tsvetan Lazarov” № 2

Correspondence details:

Phone: 02 915 3 518
Email: kzld@government.bg, kzld@cpdp.bg
Website: www.cpdp.bg

Changes to the privacy policy

Profi Travel Center Ltd may change this Policy at any time. Any changes will be immediately brought to the attention of the persons affected.

We thank you for your trust and assure you that we comply with the requirements for the processing of personal data of individuals and their protection, as well as the rules regarding the free flow of personal data.