INFORMATION ON THE PROCESSING OF PERSONAL DATA

Benefit Systems Bulgaria OOD, UIC 203418971 (“Benefit Systems”), in its capacity as a personal data controller, processes my personal data and the personal data of my child as follows:

·         Child’s first name and surname, month and year of birth of the child — for the purposes of issuing and using a monthly test MultiSport Kids card (the “Card”), in accordance with the information below and the rules published on the website: https://benefitsystems.bg/.

·         First name, surname, email address and telephone number of the parent/legal representative — processed by the controller for the purposes of providing the service, carrying out marketing communication in relation to services under the MultiSport programme and receiving information about services under the MultiSport programme.

·         Name of the employer of the parent/legal representative — may be processed by the controller for the purposes of statistical and marketing analysis, which will be used solely internally in order to determine users’ interest in the service.

Contact details of Benefit Systems Bulgaria OOD: Address: Sofia 1407, Lozenets District, 51 Cherni Vrah Blvd., Business Garden Office X, Building 1, 7th floor, Email: dpo@benefitsystems.bg

Information regarding the processing of personal data

1.      The Card is personal; therefore, it is necessary to provide the child’s first name and surname, as well as the month and year of birth of the child. During the first visit to a sports venue that is part of the MultiSport programme, the Card user must present an identity document in order to verify whether the data in the document matches the data displayed on the Card.

2.      The telephone number and email address are necessary so that, if needed, the parent/legal representative may be contacted in relation to the use of the Card or the consent given for the processing of personal data, or, where consent has been given, for marketing communication to be carried out — for example, in order to make a telephone call after the expiry of the Card’s test period, Benefit Systems may also process the user’s telephone number for this purpose.

3.      In order to settle its financial relations with the persons managing the sports venues where the Card may be used, as well as for the purpose of preventing and/or verifying unauthorised use of the Card, Benefit Systems will process (collect — through the sports venues, store and use) information about the services used through the Card (sports centres visited, services used, dates of visits).

4.      After the expiry of the Card’s validity period and the payment by Benefit Systems to the sports venues for the services used through the Card, Benefit Systems will continue to store the data in encrypted and/or pseudonymised form and/or by other secure means, in accordance with the requirements of the law, if such storage is required by applicable legislation (tax, accounting or other) and/or for the purpose of ensuring legal protection in the event of possible legal claims.

5.      The legal grounds on which Benefit Systems processes the specified personal data are as follows: the consent of the parent/legal representative to provide the data necessary for the issuance and use of the Card; compliance with a legal obligation to store tax or accounting documentation after the expiry of the test period; the legitimate interest of Benefit Systems to verify unauthorised use of the Card and to store data for the purpose of legal protection in the event of possible legal claims.

Rights in relation to the processing of personal data

6.      Pursuant to the General Data Protection Regulation (Regulation (EU) 2016/679, hereinafter referred to as the “Regulation”), the user has the following rights in relation to the processing of personal data:

·         the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal — exercisable by contacting Benefit Systems using the contact details specified above;

·         the right of access to personal data (i.e. to receive information as to whether their personal data is being processed, a copy of the data being processed, as well as information regarding the purpose of the processing and to whom the data has been or will be disclosed);

·         the right to rectification of personal data (i.e. to request correction of inaccuracies in personal data or completion of incomplete personal data);

·         the right to erasure of personal data (i.e. to request deletion of personal data under the conditions of Article 17 of the Regulation, including data for which there is no ground for processing or which has been unlawfully processed);

·         the right to restriction of processing of personal data (i.e. to request that the personal data continue to be stored, but not otherwise processed);

·         the right to data portability (i.e. to receive the personal data in a structured, commonly used and machine-readable format);

·         the right to object to the processing of personal data for direct marketing purposes (insofar as personal data is processed for such purposes);

·         the right to lodge a complaint with the Commission for Personal Data Protection in the event of a breach of the applicable personal data protection legislation.

The above rights may be exercised by submitting a written or electronic request that complies with the requirements of the Personal Data Protection Act, sent to the contact details of Benefit Systems specified above, and the right to lodge a complaint may be exercised by submitting such complaint to the Commission for Personal Data Protection.