This document contains the Personal Data Security Policy for Individuals ("Policy") and forms an integral part of the Terms and Conditions. If you do not agree to the Terms and Conditions, you may not use the Site - https://www.girlsofsofia.com/ as well as to enter into contracts with "The Girls of Sofia" Ltd.. If the Policy changes, the changes will be posted here.

Update date: 27 December 2023

PERSONAL DATA SECURITY POLICY

            Your privacy is extremely important to us. This security policy discloses what personal data we collect from you through our relationship and how we use that data.

In order to accept membership application/request, hold events, post photos and videos of events organized by us on the site  https://www.girlsofsofia.com/as well as on Facebook pages related to us, "The Girls of Sofia" Ltd ("WE", "us") with registered office and management address. "The Girls of Sofia", registered office and headquarters. 1505 Oborishte Blvd. "Gulabets" № 2, inc. A, fl. 1, app. 2, processes data of natural persons ("Data Subjects"/"You"/"Your"), in accordance with this Policy.

"The Girls of Sofia" Ltd. is the data controller in respect of information collected when browsing this site, accepting membership applications, registering to attend events, receiving enquiries, and entering into contracts - for membership, advertising, partnerships and more. In processing personal data, Sofia's Girls Ltd complies with all data protection legislation applicable to its activities, including but not limited to Regulation (EU) 2016/679 ("Regulation") and the Data Protection Act, because the security of our individuals' personal data is of paramount importance to us.

Partners and third parties who work with or for Sofia Girls Club Ltd, and who have or may have access to personal data, will be expected to read, understand and comply with this Policy. No third party may have access to personal data held by Ladies' Club "The Girls of Sofia" Ltd without first entering into a data confidentiality agreement which imposes obligations on the third party which are no less onerous than those which Ladies' Club "The Girls of Sofia" Ltd has undertaken and which entitles Ladies' Club "The Girls of Sofia" Ltd to carry out checks on compliance with the obligations imposed by the agreement.

According to the Regulation, personal data is any information relating to you by which you can be identified or are already identified.

Processing of personal data ("Processing") means any act or set of acts which may be performed upon personal data, whether or not by automatic means.

I. Categories of subjects whose personal data WE process:

In connection with the provision of services, conclusion and performance of contracts, WE we process information about the following Data Subjects:

(a) individuals using the Site without registration;

(b) individuals using the Site by registering as users and members of Ladies Club "The Girls of Sofia" Ltd; 

(c) individuals who have made enquiries (including by calling), requests, signals, complaints or other correspondence to Ladies Club "The Girls of Sofia" Ltd;

(d) individuals whose information is contained in enquiries (including by call), requests, signals, complaints or other correspondence addressed to Ladies Club "The Girls of Sofia" Ltd; 

(e) individuals with whom WE enter into membership agreements to Ladies Club "The Girls of Sofia" Ltd.  and other contracts;

This policy applies to all employees (and stakeholders) of Ladies Club "The Girls of Sofia" Ltd, as external suppliers. Any violation of the General Regulation will be treated as a breach of labour discipline and, in the event that there is an allegation that a criminal offence has been committed, the matter will be referred as soon as possible to the relevant public authorities for consideration.

When selecting employees Ladies Club "The Girls of Sofia" Ltd, processes personal data of candidates in order to assess their abilities and determine the most suitable candidate for the position. In case of consent from the candidate, Ladies' Club Sofia Girls Ltd. stores his/her cover letter and/or CV in order to offer a job opportunity when a vacancy subsequently arises.

II. Personal data we process:

1. Which you provide:

It is impossible for us to provide services, to conclude and execute contracts with you, to respond to your inquiries, to admit you to an event for which you have requested participation, if you do not provide us with information. In this regard, we require certain information from you. You decide whether and how to use the services provided through the Site. In the forms through which personal data is entered, we clearly indicate the mandatory or voluntary nature of the data provided. The data that is mandatory to fill in is data without which it is impossible for us to provide the service you have chosen or to conclude or execute a Membership Agreement with Ladies Club "The Girls of Sofia" Ltd. 

If you provide your personal data to Ladies Club "The Girls of Sofia" Ltd, via Facebook, Instagram, TikTok or any other social network, we inform you that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. In this regard, we recommend that you check these rules before sending us your personal data via these websites/apps.

Processing of comments and publications

If you leave a post or comment on the Site - https:/ /www.girlsofsofia.com/ , your IP address will be saved. This is for the safety of the website operator. violates the lawhe would like to be able to trace your identity.

Correspondence, complaints and signals

In order to resolve complaints, signals, disputes, inquiries, requests or other issues raised in communication to Ladies Club "The Girls of Sofia" Ltd. received through electronic forms on the Site, through calls to the switchboard of the Ladies Club "The Girls of Sofia" Ltd. , by sending by regular or e-mail or via social networks, We store and process this information as well as the result of this processing.

Subscriptions

The Site allows you to subscribe and receive notifications to your email address of new listings/promotions/collections/ posted on the Site with criteria of your choice or from models/websites/shops of your choice. The service can be used with or without registration. In case you use the service without registration, it is necessary to provide an email address to which you wish to receive the subscription. The subscription can be terminated at any time.

Special categories of (sensitive) data

The functionalities provided on the Site are not intended for the storage and processing of special categories of data within the meaning of Articles 9 and 10 of the Regulation. (NB! Read Article 9 and Article 10 - of the Regulation here). In cases where such is required (e.g. a financial relationship between you and us), the processing of this data is secure and we cannot continue our partnership without it.

Other data

Ladies Club "The Girls of Sofia" Ltd. may also process other data relating to you where you voluntarily provide such data by completing the relevant electronic consent form on the Site, adding preferences, settings, etc. in order for us to enter into an agreement or to fulfil your request.

2. Which are related to the process of using the Site.

In addition, we collect information from your computer, phone, tablet or other device that you use in order to perform a service of your choice, conclude and execute a contract. This information may include the following:

• the identifier of the device you are using, the type of that device, an advertising ID and a unique token for that device.
• location information, including location information from your mobile device. Note that most mobile devices allow you to control or disable the use of location services from any application on your mobile device in the device settings menu.
• computer and connection information, such as page view statistics, traffic to and from the Sites, referrer URL, advertising data, IP address, browsing history, information about your web log, and language, date and time settings.

3. Which we receive from third parties:

There are situations where we receive information from our other partners or automatically collect other information. We supplement the personal information we collect directly from you with information collected from third parties and add it to your account information.

For example, we collect and use demographic and other information that is publicly available, additional contact information, credit monitoring information and information from credit bureaus.

Next, you have the option to share information with social networks or use their sites to create your profile or link your account on our website to the relevant social network. In this case, the social network may provide us with automatic access to certain personal information they have collected about you (e.g., the content you have viewed, the content you want, and information about the ads you have been shown or clicked on, etc.). By linking your social network profile to your account on our website, you authorize us to access your personal data processed by the relevant social network, and to collect, use and retain that information in accordance with this Security Policy. This linking of a social network account to a registration on our website is made in the event that you click on a link provided to create a Registration on our website by engaging in social media, thereby voluntarily establishing a link to the relevant social media site.

If you provide us with personal information about someone else, you must do so only with that person's authorization. You must inform them how we collect, use, disclose and store personal information in accordance with this Personal Information Security Policy.

In addition, due to the fact that sending a request, comment to Us constitutes sending an electronic statement, under the Electronic Document and Electronic Certification Services Act ("EDCS Act") we have an obligation to maintain a log of the fact of sending the statement (without its content) for a period of 1 /one/ year. The log contains the date of the statement, the sender's name and email address, and the recipient's identification.

The quick links to repeat previous searches allow you to repeat your searches instead of entering them each time. The functionality can be used with or without registration. When you use the Site, a cookie with a randomly generated number is stored in your browser, enabling the Site to show you quick links to repeat previous searches. The Site stores and displays the last 10 searches associated with that browser, which you can save and use in your account when you log in. In case you use the Service with registration, the last 10 searches are stored in your account.

Logs related to security, technical support, development, etc.

The Site uses logs for the following purposes:

• To ensure the reliable operation of the Services and to identify technical problems;
• To secure the Services and detect malicious activity;
• To develop and improve the Services on the Site;
• To measure Site traffic and usability;
• Logs where required by law (such as logs of electronic wills).
• Login log. This log allows unauthorized attempts to access accounts to be detected and automatically blocked. It is maintained for a period of up to 1 /one/ year, and contains the date and time of login, status, whether the login is via mobile version, app or desktop browser, IP address.
• Server logs, security logs (Web Application Firewalls) and other devices that fall into this category. These logs are necessary for detecting technical problems, detecting malicious activities, etc. for the purposes mentioned above. They are stored for a period of up to 1 /one/ year. The logs may contain the following information: date and time, IP address, URL, browser and device information. In addition, some devices may use cookie-based security technology.

Biscuits

The use of cookies is necessary for the functioning of the Site. In this regard, a Cookie Policy has been adopted.

III. For what purposes we process your personal data:

The main purpose for which WE process your personal data is generally related to the services provided by Ladies Club "The Girls of Sofia" Ltd, entering into and executing Membership, Advertising and other Contracts and holding events organised by us. We use your personal information to provide you with a personalized experience on our site, to contact you about your account and our Services, to provide you with customer service, to provide you with personalized advertising and marketing tailored to your interests, and to detect, mitigate and investigate fraudulent or illegal activities.

Ladies Club "The Girls of Sofia" Ltd. collect, use and process the information described above for the purposes set out in this Policy, which may include:

• the conclusion of a Membership Agreement between you and Ladies Club "The Girls of Sofia" Ltd. - we require your identification, contact and payment details in order to enter into a contract with you;
• protect and enforce the legitimate interests of other users of the Services, third parties and Ladies Club "The Girls of Sofia" Ltd.;
• the fulfilment of legal obligations of Ladies Club "The Girls of Sofia" Ltd..
• fulfill the executed Membership Agreement or fulfill an order from the Site https://www.girlsofsofia.com/ (please note that we may retain your data for a reasonable period of time after you have completed the transaction in order to fulfill any contractual obligations such as refunds, warranties, etc., and to satisfy any legal obligations to retain transaction data);
• informing you about products, events and services you would like us to send you information about by email, post, mobile phone and/or other digital means (depending on your stated preferences), including social media platforms;
• the provision of services you request from us;
• your registration on the website (in which case We will also use your personal information to maintain and update your account (such as changing your address or changing your marketing preferences);
• website administration;
• administering any events, raffles or lottery games conducted by Ladies Club "The Girls of Sofia" Ltd.
• measuring and analysing our advertising;
• keeping our website and network secure and safe;
• processing payments and preventing fraudulent transactions (we may pass your data to a third party to perform these functions);
• contact you about your account, troubleshoot problems with your account. When we contact you by phone to ensure efficiency, we may use automated or prerecorded calls and text messages.
• provide you with location-based services (such as advertising, search results and other personalised content)

Our legitimate interest the processing of your personal data is driven by the need to ensure the protection and safeguarding of the legitimate interests of Ladies Club "The Girls of Sofia" Ltd. and/or third parties, which is related to:

• ensuring the normal use of the Site by you and other users, resolving disputes, identifying and preventing malicious activity.
• detecting and resolving technical or functionality problems, developing and improving the purpose of the Site.
• communicating with you, including electronically, on important matters relating to the provision of services by Ladies Club "The Girls of Sofia" Ltd., conclusion and execution of the Membership Contract.
• targeting our marketing, updating services and offering you promotional offers based on your preferences.
• receiving and processing signals, complaints, requests and other correspondence received;
• the exercise and protection of the rights and legitimate interests of Ladies Club "The Girls of Sofia" Ltd.including in court, and assisting in the enforcement and protection of the rights and legitimate interests of other users of the site and/or third parties affected.

For these purposes, it may be necessary to process some or all of the above categories.

Our legal obligations include fulfillment of statutory obligations to preserve or provide information upon receipt of an appropriate order from competent state or judicial authorities, when ensuring the possibility of exercising the control powers of the competent state authorities, when fulfilling obligations provided for in the Data Protection Regulation related to notifying you of various circumstances related to your rights, the Services provided or the protection of your data, etc. similar. For these purposes, it may be necessary to process some or all of the above categories.

Your data may be processed on the basis of Your explicit consent, in which case the processing shall be specific and to the extent and scope provided for in the relevant consent.

For the processing of your personal data we use partially automated algorithms and methods in order to continuously improve our products and services, to make them more personal to you, to adapt our products and services to your needs in the best possible way or to calculate. This process is called profiling.

IV. How long do we keep your personal data?

In data storage, Ladies Club "The Girls of Sofia" Ltd. apply the general principle of storing data in the minimum amount and for no longer than is necessary for the provision of services, the conclusion and performance of contracts, to ensure their security and reliability and the requirements of the law.

For more information see The table.

In the event of contact with customer service, we will retain this data for as long as necessary to resolve your request and for a short period after closing the same.

When you make a payment through our website (for example, to attend a paid event), we will retain certain limited personal information, such as your name, email address, and mailing address, until you ask us to update or delete that data for the purpose of reporting new and existing users to our partner advertisers. We retain transaction information for as long as required by law. We will retain your web browser history information for a similar period.

If we are legally obligated or if reasonably necessary to comply with regulatory requirements, resolve disputes, prevent fraud and abuse, or enforce our terms, we may also retain some of your personal information for a limited period of time, even after you have closed your account.

In the event of a legal dispute or proceeding requiring the retention of data and/or a request from a competent government authority, it is possible to retain data for longer than the specified periods until the final conclusion of the dispute or proceeding before all instances. These time limits may be modified in the event that a different retention requirement is established under applicable law.

Backup. In order to ensure the reliability of the Services and prevent data loss for technical reasons, the Site applies a data redundancy policy. The maximum update period (including data deletion) for all backups is 30 days.

V. Do we share your personal data with third parties?

Ladies Club "The Girls of Sofia" Ltd. not provide Your personal data to third parties in any other way except as described in this Policy and as provided by law. We strive to minimize the personal data we disclose, as this is always directly related and necessary to achieve the stated purpose. We do not sell, rent or otherwise disclose your personal information to third parties for their marketing and advertising purposes without your consent.

To provide the best contract terms with our partners, Ladies Club "The Girls of Sofia" Ltd. provides your personal data to:

• our employees, professional advisors, including, without limitation, our underwriters
• vendors, business partners, and contractors who help us provide our Payment Processing Services, help us deliver customized advertisements, assist us in preventing, detecting, mitigating, and investigating potentially illegal security activities related to account collections, affiliate and rewards programs, co-branded credit cards, and other business transactions.
• third-party financial institutions with whom we offer financial products to provide you with joint content and services (such as registration, transaction and customer support). These third-party partners will only use your personal information to send you marketing messages if you have requested it.
• third party website, application, service and tool providers with whom we partner so that they can publish or advertise your listings and their content on their websites or in their applications, services and tools. Women's Business Club High Tops is not responsible for the processing of your personal data by these third parties.
• a competent governmental or judicial authority, if duly requested, in order to detect, investigate, mitigate and prevent potentially fraudulent and unlawful acts against data security.
• persons for whom we have your explicit consent to provide your personal data
• third parties in order to protect the rights and legitimate interests of Ladies Club "The Girls of Sofia" Ltd. and/or other users of the Site
• our third-party advertisers in order to provide personalised advertising
• search engine and web analytics providers.

In dealing with the above categories of persons to whom we provide your personal data, WE require them to strictly comply with our instructions in accordance with this Policy.

In the event of a merger, acquisition or sale of assets affecting the processing of personal data, you will be notified in advance.

We may also disclose your personal data where we are subject to a legal obligation to do so in connection with the prevention or detection of crime, in order to establish, exercise or defend our legal rights, or where we believe we have received a valid request for disclosure. This includes sharing information with other companies and organisations to protect fraud and reduce credit risk.

You should be aware that if we are asked by the police or any other regulatory or government body investigating suspected illegal activities to provide your personal information or other information we obtain about you, we have the right to do so.

Our website may also contain links to and from third party websites. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we accept no responsibility or liability for these policies. Please check these policies before submitting information to these websites.

Our site uses YouTube LLC, represented by Google Inc. to integrate videos. Typically, when you visit an embedded video page, your IP address will be sent to YouTube and cookies will be installed on your machine. However, our YouTube videos are integrated in an extended privacy mode (in this case, YouTube is still in contact with the DoubleClick service from Google, but personal data in accordance with Google's privacy policy is not used). As a result, YouTube does not store any visitor information unless you watch the video itself. If you click on the video, your IP address will be sent to YouTube and YouTube will know that you watched the video. If you are logged into YouTube via your user profile, this information will also be linked to your user profile (you can prevent this by logging out of YouTube before clicking on the video to view it).We have no information about the possible collection and use of your data by YouTube. For more information, please see YouTube's privacy policy at www.google.com/intl/bg/policies/privacy/.

The information we collect from you may be transferred to and stored outside the European Economic Area ("EEA"). It may also be processed by staff working outside the EEA who work for us or one of our suppliers. In this case, the third country's data protection laws will be approved as adequate by the European Commission or other applicable safeguards will be applied.

VI. Your rights regarding personal data

Under the General Data Protection Regulation you have the following rights:

• Right to information.

This Policy is intended to inform you in detail about the processing of your personal data in relation to the processing of your personal data.

• Right of access.

You have the right to confirm whether your personal data is being processed, to access it and to obtain information about how it is being processed and your rights in relation to it. You can access this at any time by emailing our Data Protection Officer: [email protected].

• Right to rectification.

You have the right to correct and complete your personal data in case it is incomplete or inaccurate. You have the opportunity to correct your data at any time by emailing our Data Protection Officer. 

• Right to erasure (right to be forgotten).

You have the right to request the erasure of data, except where there is a substantial ground for processing and/or a legal obligation.

• Closing an account.

If you wish, you have the option to close your account at any time, using the functionality provided for this in your account, and in case of difficulties by submitting a request by email to our Data Protection Officer. 

After the account is closed, all or, as the case may be, part of the data is deleted. In connection with our obligations, responsibilities and the requirements of the law for a period of up to 1 /one/ year are stored for the purpose of resolving possible disputes that arose or became known after the closure of the account. See the section "How long do we keep your information?".

In order to ensure the reliability of the services and to prevent data loss due to technical reasons, the Site applies a data redundancy policy. The maximum period for updating (deleting data) from all backups is 30 days.

• Right to restriction in relation to data processing.

The General Data Protection Regulation provides for the possibility to restrict the processing of your personal data if there are grounds for doing so set out therein.

• Right to notify third parties.

Where applicable, you have the right to request the Controller of your personal data to notify third parties, where he has provided your data, regarding the rectification, erasure or restriction of the processing of your personal data.

• Right to data portability.

You have the right to receive the personal data concerning you that you have provided in a structured, commonly used and machine-readable format and have the right to transfer that data to another controller without hindrance from us, if the processing is based on consent or a contractual obligation or the processing is carried out in an automated manner. The Site provides functionality that allows you to export your desired information.

Important: The responsibility for the storage of data exported from the Site, as well as for any consequences of providing it to other administrators is entirely yours.

• The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, unless there are grounds for doing so under applicable data protection law and appropriate safeguards are provided to protect your rights, freedoms and legitimate interests.

No technologies falling into this category are used in the provision of the Services on the Site.

• Right to withdraw consent.

You have the right, at any time, to withdraw the consent you have given in relation to the processing of personal data on the grounds - your consent. Such withdrawal shall not affect the lawfulness of the processing on the basis of the consent given up to the time of withdrawal.

In the case of services such as the subscription to email advertisements, the subscription to which is based on your wish (consent), there is an option to terminate the subscription at any time (withdrawal of consent).

• Right to object.

You have the right to object to data processed on the basis of legitimate interest.

In the event that such an objection is received, We will consider Your request and, if justified, comply with it. If we consider that there are compelling legitimate grounds for the processing or that it is necessary for the establishment, exercise or defence of legal claims, we will inform you of this.

• Right of appeal to a supervisory authority.

You have the right to lodge a complaint with the supervisory authority if you consider that the processing of personal data concerning you violates applicable data protection law. The supervisory authority in the Republic of Bulgaria is the Commission for Personal Data Protection, whose address is. 1592 Sofia Blvd. "1595 Prof. 2.

In the event that you exercise these rights manifestly unreasonably or excessively, in particular because of their repetitive nature,  Ladies Club "The Girls of Sofia" Ltd. reserves the right to charge a reasonable fee, taking into account the administrative costs of providing the information or communication or taking the action requested, or to refuse to act on the request.

VII. Accuracy of information

Ladies Club "The Girls of Sofia" Ltd. is not responsible for the correctness of the data you provide, does not carry out any checks in this respect and does not guarantee the true identity of the individuals who have provided the data. In all cases of suspicion on your part, of fraud and/or abuse detected, please notify us immediately. You undertake that when providing any information on the Site, you will not violate the rights of others in relation to the protection of their personal data or their other rights.

VIII. How we protect your personal data

In order to ensure the best possible protection of the data of Ladies Club "The Girls of Sofia" Ltd. and its users and members , WE implement all necessary organisational and technical measures provided for in the General Data Protection Regulation and the Data Protection Act, as well as best practice international standards.

Ladies Club "The Girls of Sofia" Ltd. has adopted the necessary rules and procedures relating to the lawful processing of your personal data, including. Data Breach Action Plan, has established structures to prevent misuse and security breaches, and has appointed a Data Protection Officer and a Data Protection Committee to support the processes of lawful processing, protection and security of your data.

For maximum security in the processing, transmission and storage of your data, we may use additional security mechanisms such as encryption, pseudonymization, etc.

IX. Cookie Policy

As an integral part of this Privacy Policy, the Ladies Club "The Girls of Sofia" Ltd. has also adopted a Cookie Policy, for which a dedicated category has been created.