PERSONAL DATA PROTECTION POLICY
I. GENERAL INFORMATION
BENEFIT SYSTEMS BULGARIA EOOD, registered with the Bulgarian Commercial Register under UIC 203418971, with the seat in Sofia 1612, Krasno selo region, Bulgaria, 11-13 Yunak Str, fl. 1 (hereinafter: “Benefit Systems”, “us”, “we”) treats protection of personal data very seriously. We exercise all due care and diligence to ensure that your personal data are processed in accordance with the applicable regulations including the regulations of the EU, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation or GDPR in short).
Benefit Systems views the security of the data stored by us as priority. We have implemented appropriate policies and procedures in this respect. We conduct trainings of our staff with regard to data protection, data confidentiality and security. We also conduct regular checks of the implemented security models in terms of their adequacy to the security of the data held by us.
In the course of provision of its services Benefit Systems needs to process personal data concerning the natural persons who use MultiSport cards (ie MultiSport card users) in the capacity of a personal data controller within the meaning of the GDPR.
The purpose of this document is to inform MultiSport card users about:
– the scope of the personal data processed by Benefit Systems in the course of provision of its services, the purposes and the legal basis of the processing as well as other information relevant to the processing;
– the rights of the MultiSport card users in relation to the personal data processed by us.
II. WHAT IS PERSONAL DATA AND PERSONAL DATA PROCESSING
Personal data means any information related to an identified or identifiable natural person (e.g. first and last name, electronic mail address, name of employer, etc.). Benefit Systems processes personal data for various purposes (please see below). The legal basis for data collection, processing and storage may be different depending on the purpose of these operations.
Processing is any operation or set of operations which is performed on personal data (such as its collection, storage, erasure or transfer). According to our policy we only collect personal data when it is necessary for specific purposes.
III. WHAT PERSONAL DATA DO WE NEED AND WHY (SCOPE OF PERSONAL DATA PROCESSED AND PURPOSES OF THE PROCESSING)
Benefit Systems needs to process personal data relating to MultiSport card users (data subjects within the meaning of the GDPR) for the purposes of performance of the agreements for provision of services signed between Benefit Systems and the client companies (usually employers) paying for the use of the MultiSport cards. In particular:
1. in order to issue a MultiSport card to a particular user, Benefit Systems needs the first and the last name of the user, as well as the name of the client company. These are usually printed on the MultiSport card together with a unique number of the MultiSport card;
2. if the agreement between Benefit Systems and the client company provides for payment of a fee for the issuance of a duplicate to a lost/stolen/broken/damaged MultiSport card, Benefit Systems may store information on the number of times a specific MultiSport card is reported lost/stolen/broken/damaged;
3. in order the MultiSport card user to be able to use sports, recreational and other services included in the MultiSport Program through the issued MultiSport card, Benefit Systems needs to process information about the sport facilities visited, date of the visit, as well as the services used by the respective MultiSport user. This information is collected by the staff of the sports facilities visited by the MultiSport card users. Our partners operating the sports facilities visited by MultiSport card users process such personal data only under the instructions of Benefit Systems and are obligated to apply GDPR as well;
4. in order the MultiSport card user to be able to use sports, recreational and other services included in the MultiSport Program, when visiting a sport facility, the MultiSport card user should identify him/herself by showing an identification document, issued by the competent governmental, municipal, educational or other authority, containing his/her name, surname and a photograph (e.g. ID card, driving license, student’s book or card, card for public transportation services, etc.). This is necessary for the purposes of verification that the person who uses the MultiSport card is actually the person whose name is printed on the MultiSport card.
Important! Benefit Systems does not need or request any copies of identification documents. So, if MultiSport card users are requested to present such copies, they are entitled to refuse and are further encouraged to contact Benefit Systems immediately in order to inform for such practices;
6. in order Benefit Systems to process and respond to requests/enquiries/complaints submitted by MultiSport card users, Benefit Systems may need to process the following personal data:
– name and surname of the MultiSport card user, number of the MultiSport card, name of company, etc.;
– his/her e-mail address (if the communication is sent via e-mail) or telephone number (if the communication is conducted by phone) or address (if the communication is sent by mail);
– the information provided in the request/enquiry/complaint.
7. for the purposes of defending Benefit Systems’ legal rights against claims of MultiSport card users, client companies or partnering sport facilities Benefit Systems may need to store MultiSport card users’ personal data described above for a certain period after termination of the agreements between Benefit Systems and the respective client company and/or between Benefit Systems and the respective partnering sport facility;
8. for the purposes of compliance with applicable tax, accounting or other legislation Benefit Systems may also need to store MultiSport card users’ personal data described above for a certain period after termination of the agreements between Benefit Systems and the respective client company and/or between Benefit Systems and the respective partnering sport facility and/or between Benefit Systems and the respective MultiSport card user (in case of there is such an agreement);
10. for the purposes of expanding its partners network (ie in order to add more partnering sports facilities) Benefit Systems may process aggregate statistical information concerning sport facilities visited or services used by MultiSport card users.
Benefit Systems processes the above data under the following legal grounds:
– consent for personal data processing given by the MultiSport card user;
– performance of a contract to which the MultiSport card user is a party (in case there is an agreement between the respective MultiSport card user and Benefit Systems);
– compliance with a legal obligation to which Benefit Systems is subject (e.g. tax, accounting, etc.);
– for the purposes of the legitimate interests pursued by Benefit Systems as pointed hereinabove.
IV. HOW DO WE COLLECT PERSONAL DATA
Personal data is collected through different communication channels such as:
– from an employer (client company) that signed an agreement with Benefit Systems about its employees joining the Multisport program. In such cases the employer discloses to Benefit Systems only the personal data necessary for issuance of the MultiSport cards – first name and last name of the user of the MultiSport card and name of the client company (ie the employer);
– from an employer that expressed its interest in joining the Multisport program;
– directly from the MultiSport card user upon registration on an online user platform designed by Benefit Systems specifically for that purpose;
– directly from the MultiSport card user upon a visit to a sport facility;
– directly from the MultiSport card user in case of voluntary participation (as a member of the Multisport program) in certain marketing activities of Benefit Systems (e.g. (sport) contests and/or surveys, etc.).
V. HOW LONG DO WE RETAIN PERSONAL DATA
All personal data processed by Benefit Systems is processed for a limited period of time. Depending on the purpose, Benefit Systems stores personal data for particular periods of time, specified below:
– for the purpose of provision of Benefit Systems’s services: until any claims become time-barred;
– for the purpose of direct marketing: until a MultiSport card user resigns from membership in the Multisport program; until they object to the processing of their personal data, or until they revoke their consent, whichever occurs first;
– for tax and accounting purposes: for the time and to the extent required by the applicable law.
VI. RECIPIENTS OF PERSONAL DATA
Provided that disclosure is compliant with the relevant data protection laws, Benefit Systems may share your data with:
– printing houses that print MultiSport user cards;
– partners (sports and recreation facilities) record data only when they need to register MultiSport card users’ visits and use of services in their facility;
– providers of additional services available within the framework of the MultiSport Program (e.g. organizers of sports contests or other events which MultiSport card users have requested to take part in);
– entities providing IT systems and maintenance of terminals (such as barcode readers at the sports facilities) as well as other maintenance services, entities supporting electronic payment services, entities providing services related to MultiSport card users service and supporting our marketing activities;
– entities that provide Benefit Systems with legal, accounting, consulting and audit services (if necessary);
– If Benefit Systems is required by law, Benefit Systems may share personal data with competent authorities (e.g. for tax purposes or similar).
Because Benefit Systems is part of the Benefit Systems Group, MultiSport card users’ personal data are transferred to:
– Benefit Systems International Sp. z o.o., Plac Europejski 2, 00-844 Warsaw, Poland
– Benefit System SA, Pl. Europejski 2, 00-844 Warsaw, Poland
Benefit Systems does not transfer personal data outside the EU.
VII. RIGHTS OF INDIVIDUALS REGARDING PERSONAL DATA
MultiSport card users have the following rights connected to processing of personal data which they can exercise at any time by contacting Benefit Systems:
– by email: firstname.lastname@example.org;
– by regular mail to the address of Benefit Systems: Sofia 1612, 11-13 Yunak str., fl.1, please mark the envelope “Personal Data”;
– through a contact form: https://www.benefitsystems.bg/contacts/
When exercising the rights regarding personal data, MultiSport card users may be asked to identify themselves – by providing an identity document, by electronic signature or other methods and means of identification mentioned in the Bulgarian Personal Data Protection Act or other relevant act.
1. Right of access to personal data
MultiSport card users have the right of access to data that Benefit Systems processes as the data controller, which means that MultiSport card users are entitled to obtain from Benefit Systems confirmation as to whether or not personal data concerning the respective MultiSport card user is being processed and, where that is the case, access to the personal data processed (i.e. to receive a copy of it).
2. Right to demand rectification of personal data
MultiSport card users can update their personal data at any time if the personal data is inaccurate or incomplete.
After Benefit Systems receives a notification from the employer (or the MultiSport card user, if the former is not applicable) that any personal data processed by Benefit Systems is no longer up to date, Benefit Systems will rectify the data based on the updated information provided that the change is possible. Updating the data can take up to 5 business days which is related to the technical conditions of Benefit Systems’s systems.
3. Right of withdrawal of consent for processing of personal data
If personal data is processed based on the base of consent, the MultiSport card user has the right to withdraw the consent at any time. In order to withdraw the consent to processing of personal data, please contact us in the manner provided in this Policy.
4. Right of objection to the processing of personal data
MultiSport card users have the right to object to the processing of their personal data, if processing of the personal data takes place based on the legitimate interest of Benefit Systems or the personal data is processed for the purposes of direct marketing.
5. Right of restriction of processing
MultiSport card users have the right to restrict the processing of their personal data, if:
– the accuracy of the personal data is contested by a MultiSport card user, for a period enabling the controller to verify the accuracy of the personal data; or
– the processing is unlawful and the MultiSport card user opposes the erasure of the personal data and requests the restriction of their use instead; or
– Benefit Systems no longer needs the personal data for the purposes of the processing, but they are required by the MultiSport card user for the establishment, exercise or defence of legal claims; or
– MultiSport card user has objected to the processing.
6. Right to transfer personal data
MultiSport card users have the right to receive their data from Benefit Systems in a structured, commonly used and machine-readable format. MultiSport card users can also request that Benefit Systems transmits it to another data controller, if the data transfer is technically feasible and the other controller agrees to accept it.
7. Right to be forgotten (Right to erasure)
MultiSport card users can submit to Benefit Systems a request to erase their data and have their data erased if the personal data is no longer necessary in relation to the purposes for which they were collected by Benefit Systems; where MultiSport card users have withdrawn their consent or objected to the processing of personal data concerning them, or where personal data are processed against the law.
8. Right to lodge a complaint with a supervisory authority
MultiSport card users are entitled to lodge a complaint with the Bulgarian Commission for Personal Data Protection in case their rights as data subjects have been infringed.
VIII. AMENDMENTS TO THE PRESENT POLICY
Benefit Systems is going to review and update the present document regularly in connection with the changes in the law and the efforts made by Benefit Systems to improve the level of security of personal data and the quality of service.
The last update of the present document took place on 24/05/2018.
IX. CONTACT US AT ANY TIME
– by a letter to: Benefit Systems Bulgaria EOOD, Bulgaria, Sofia 1612, 11-13 Yunak Str., fl. 1, please mark the envelope “Personal data”;
– by email: email@example.com;
– by telephone at: +359 2 820 57 70 and +359 879 280 284;
– by filling in a contact form at: https://benefitsystems.bg/contacts.