PERSONAL DATA PROTECTION POLICY
for users of the mobile application “Public Transport Stara Zagora” (in Bulgarian: „Градски транспорт Стара Загора“)
This Personal Data Protection Policy has been adopted in accordance with the requirements of REGULATION (EU) 2016/679 of the European Parliament and of the Council and aims to inform you of your rights in connection with the processing of your personal data. Please read this document carefully, as it has been created to explain the basic rules that the municipal enterprise “Troleybusni i Avtobusni Prevozi” EOOD, Stara Zagora (hereinafter referred to as the Company) applies when collecting and processing your personal data.
Please note that the Mobile Application does not use cookies, nor does it collect any personal data other than those expressly specified in this Policy. If the Mobile Application redirects you to other external websites, please bear in mind that “Troleybusni i Avtobusni Prevozi” EOOD is not responsible for the information collected by those websites and kindly invites you to read the personal data protection policies of the respective website.
I. PERSONAL DATA CONTROLLER:
Name and legal form: “Troleybusni i Avtobusni Prevozi” EOOD (Trolleybus and Bus Transport Ltd.),
UIC: 123732117,
VAT registered,
Registered office and address: Stara Zagora, Industrialen residential district, Trolleybus Depot,
Represented by: Dimitar Dobrev Avdzhiev,
Tel.: +35942605362; +359885912109, +359885912106
e-mail: office@szprevozi.com
Data Protection Officer: Desislava Ivanova, tel.: 0889036338
“Troleybusni i Avtobusni Prevozi” EOOD is a single-member limited liability company registered under the Commercial Act, owned by the Municipality of Stara Zagora, whose main activity is the scheduled carriage of passengers by bus and trolleybus within the Municipality of Stara Zagora.
The Company maintains the mobile application “Public Transport Stara Zagora” (hereinafter referred to as the “Application” or the “Mobile Application“) as part of its main activity. The Application was created with the aim of modernising the enterprise and improving citizens’ access to public transport and to the “public carriage of passengers” service provided within the Municipality of Stara Zagora.
The Application provides its users with information about travel options from and to a point of their choice within the Municipality of Stara Zagora by public transport, including bus, trolleybus and any other type of transport and means of travel maintained by the Municipality of Stara Zagora. In addition, the Application allows users to quickly, easily and conveniently purchase tickets for single or multiple (subscription) journeys on the public transport of the Municipality of Stara Zagora.
HOW TO CONTACT US
Anyone can contact us at any of the above address, telephone or e-mail, namely: Stara Zagora, Industrialen residential district, Trolleybus Depot, tel.: +35942605362, +359885912109, +359885912106, e-mail address: office@szprevozi.com
If you need more information about the collection of your personal data, its storage, use, disclosure, destruction, access, etc., you can contact the Data Protection Officer – Ms. Desislava Ivanova, tel.: 0889036338
II. PERSONAL DATA
What does “personal data of natural persons” mean – this is all data by which a natural person can be identified.
The personal data you provide to the Company when registering in the mobile application “Public Transport Stara Zagora“:
· First name and surname*
· Confirmation that you are 18 years of age or older**
* First name and surname, as a type of personal data, means solely your first name and surname as indicated in your identity documents. When registering through the Application itself you enter your first name and surname, while when registering through Google or Facebook the Application uses the first name and surname you have specified in Google or Facebook. Your actual first name and surname may differ from those you have specified when registering in the Application, Google or Facebook. These, however, are not personal data within the meaning of Bulgarian legislation, and the Company bears no liability whatsoever for their collection, storage, use, disclosure or destruction.
** When using the Mobile Application, when registering in it, and when purchasing a ticket or concluding a subscription, you confirm that you are 18 years of age or older. Only in this case can you use our services;
FOR WHAT PURPOSE DO YOU PROVIDE YOUR PERSONAL DATA:
1./ Conclusion and performance of a contract for the provision of the “public carriage of passengers” transport service through the use of the mobile application “Public Transport Stara Zagora”
You provide the personal data from your profile listed above so that we can conclude a contract for the “public carriage of passengers” transport services – through the purchase of a single ticket for a one-off journey or a subscription for multiple journeys across the entire city network for a period of 1 (one) month, and so that we can identify you as a party to the specific contract and establish your status as a “passenger” in the public passenger transport vehicles. In addition to the conclusion of the contract, your personal data are also collected for the performance of this contract, under which both parties – you as the User and the Company as the Provider of transport services – are obliged to fulfil the stipulated conditions within the specified time limits.
Legal basis for processing – Art. 6(1)(b) of Regulation 2016/679 of the European Parliament and of the Council; the Obligations and Contracts Act; the Commercial Act; the Civil Procedure Code; the Measures Against Money Laundering Act; the Insurance Code;
2./ Functioning of the Mobile Application
After installing the Mobile Application, it obtains access to the following information from your device: your device identifier – so that we can link the actions you perform in the Application (pressing buttons, etc.) specifically to your device and fulfil your requests; storage (phone disk space) – for installing the Application; Wi-Fi and mobile internet data – for internet access from the Application; use of the fingerprint hardware – for integration with the payment systems. Access to this data is necessary for the Application to work and to perform the functions provided in it.
Legal basis for processing – Art. 6(1)(b) of Regulation 2016/679 of the European Parliament and of the Council;
3./ Access to your location
With your consent we also obtain access to your location, which is used solely for your convenience – to show you the stops nearest to you, their timetables and the tickets available for purchase.
Access to your location is not mandatory, and your consent to it may be withdrawn at any time. Consent is withdrawn by e-mail to us, from your device settings or by deleting the Application. Please note, however, that if you withdraw your consent to access your location, you will not be able to see the stops nearest to you and the information related to them.
Legal basis for processing – Art. 6(1)(a) of Regulation 2016/679 of the European Parliament and of the Council;
4./ Protection of the Company’s rights in cases of non-performance of the contract
In addition to the conclusion and performance of the contract, your personal data are also collected for cases of non-performance of this contract. Thus, for the entire term of the contract both parties to it – you as the Buyer and the Company as the Seller – are obliged to fulfil the stipulated conditions within the specified time limits, and any action deviating from what has been agreed entitles each party to protect its rights in the appropriate manner, including through the use of the necessary personal data.
Legal basis for processing – Art. 6(1)(f) of Regulation 2016/679 of the European Parliament and of the Council; the Obligations and Contracts Act; the Commercial Act; the Civil Procedure Code; the Measures Against Money Laundering Act;
5./ Accounting and tax purposes
Data on the contracts concluded between us are stored and processed in connection with the obligation of all persons to keep and maintain tax records and to pay taxes. In this case your personal data may be processed entirely for tax purposes.
Legal basis for processing – Art. 6(1)(c) of Regulation 2016/679 of the European Parliament and of the Council; the Accountancy Act; the Corporate Income Tax Act; the Personal Income Taxes Act; the Commercial Act; the Measures Against Money Laundering Act;
HOW WE PROCESS YOUR PERSONAL DATA
Processing covers a wide range of operations performed on personal data, whether by manual or automated means. This includes collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, alignment or combination, restriction, erasure or destruction.
HOW WE STORE YOUR PERSONAL DATA
Your personal data are stored on a server owned by the enterprise.
“Troleybusni i Avtobusni Prevozi” EOOD has taken all necessary technical and organisational measures to protect your personal data, including through restricted access to the server, segregation of data, security and others.
FOR HOW LONG ARE YOUR PERSONAL DATA STORED
Your personal data are stored for different periods, depending on the purpose for which they are collected.
1./ Conclusion and performance of the contract and protection of the Company’s rights in cases of non-performance of the contract – a period of 5 years from the date on which the contract is fully and finally performed by the parties or terminated on other grounds. The moment or date on which you use the ticket you have purchased for a single or multiple journey (subscription) is considered full and final performance of the contract.
If there is non-performance of the contract and either party has taken action to protect its rights through judicial, administrative or other proceedings – up to 5 years from the date on which the final judicial, administrative or other act is issued.
2./ Data necessary for the functioning of the Mobile Application – kept until you delete the Mobile Application from your device.
3./ Access to your location – ceases at the moment you withdraw your consent.
4./ Accounting and tax purposes – a period of up to 10 years from the date of the last payment. If the revenue administration and/or other state authorities have undertaken audits and/or inspections, the retention period for personal data may be extended by the duration of the respective actions of the state administration.
HOW YOUR PERSONAL DATA ARE DESTROYED
In order to avoid any undesirable negative consequences in connection with the processing of your personal data, upon expiry of the period for which the personal data are stored, they will be destroyed.
ARE DATA DISCLOSED TO OTHER PERSONS
Your personal data may be disclosed to other persons, depending on the purposes for which the data are stored, namely:
1./ Conclusion and performance of the contract, protection of the Company’s rights in cases of non-performance of the contract and functioning of the Mobile Application – to a lawyer, court, prosecutor’s office, the State Agency for National Security (DANS), an established courier company, “Bulgarian Posts” EAD, and to persons responsible for the technical and software maintenance of equipment (IT specialists). If you wish to establish the exact names of the persons to whom your personal data have been disclosed, please contact us at the e-mail, address and telephone indicated in Section I above.
2./ Accounting and tax purposes – to accountants and accounting firms, and to the competent state and municipal authorities upon their request, e.g. the National Revenue Agency (NRA), the Local Taxes and Fees Department of the Municipality, the State Agency for National Security (DANS) and others.
3./ Statistical purposes – these data are not disclosed to other persons, with the exception of shareholders, representatives and employees of the Company and the competent state and judicial authorities, if necessary and requested by them.
ATTENTION: Your personal data may be disclosed to the Commission for Personal Data Protection in the exercise of its powers to supervise compliance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council.
III. WHAT ARE YOUR RIGHTS in connection with your personal data processed by us?
1./ Right of access to, rectification, erasure and restriction of processing of your data
You have the right to receive information as to whether we process your personal data, exactly which personal data we process, who processes them, whether they have been disclosed to other persons, for what period they are processed, what your rights are in connection with your personal data and whether you have the right to lodge a complaint. You may obtain a copy of the personal data we process. In addition, you have the right to require us to update/rectify your personal data if those we hold are inaccurate (for example, if you no longer use the e-mail address you provided to us). You have the right to request that we do not perform any operations on your data but only store them (so-called restriction of processing), as well as to request the erasure of your personal data when they are no longer necessary for the purposes for which they are processed, and after the expiry of the period for which they are stored.
IMPORTANT: You provide your personal data yourself, on the basis of your own decision, and “Troleybusni i Avtobusni Prevozi” EOOD does not carry out any profiling or automated processing of your personal data.
2./ Right to data portability
You have the right to receive the personal data you have provided to us and which we process, in a structured and commonly used format. In addition, you have the right to transfer your personal data referred to in the preceding sentence to other persons and/or controllers, either personally or through direct transfer of the data from us to another controller designated by you, where technically feasible.
3./ Right to object
The provisions of the Regulation provide for your right to object in cases where your personal data are processed for the performance of a task carried out in the public interest, or where the processing is necessary for the purposes of the legitimate interests of the Company or of a third party, i.e. where the legal grounds for processing your data are based on Art. 6(1)(e) and (f) of the Regulation. In these cases you have the right to object and to request that we cease processing your personal data. If you decide to lodge such an objection, we will review your request and respond to you in the appropriate manner within one month, unless a longer period is technologically necessary.
4./ Right to lodge a complaint
You may lodge a complaint with the Commission for Personal Data Protection to protect your rights and legitimate interests in connection with the processing of your data.
IMPORTANT: If you need additional information regarding the collection, processing, storage, destruction or any other information related to your personal data, please contact us at the address, telephone and e-mail address indicated above. Our team will answer all your questions.