PRIVACY NOTICE PURSUANT TO ARTICLE 13 OF REGULATION 2016/679 REGARDING THE PROCESSING OF PERSONAL DATA

This document provides you with summarized information about how we plan to process your personal data, what rights you have in this regard, how to exercise them, and other important details. 

Personal data is any information related to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, identification number, location data, online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person. Personal data is any information through which someone can identify you.

Data Controller Identification	Schwarz Global Services Bulgaria EOOD, a company registered under the laws of the Republic of Bulgaria, UIC 205158327. Registered office: Sofia, Lozenets District, 51 Cherni Vrah Blvd., 11th floor.
Data Protection Officer (for personal data-related inquiries only)	Veronika Andreeva, Email: sit-bg-dpo@mail.schwarz
Processing Purposes	Processing of Personal Data in Connection with: a/ Ticket Sales for Events: Personal data will be processed for the purpose of selling tickets and managing event attendance. b/ Sending Tickets and Reminder Emails: Personal data will be used to send purchased tickets and reminder emails as the event date approaches. c/ Possible Streaming: If the event is streamed, personal data may be processed in relation to broadcasting and viewing the event. d/ Event Coverage and Publications: Personal data may be processed for documenting events, including photos, videos, or articles, and optionally sending participants materials related to the event. e/ Sending a Feedback Form after the Event: Personal data may be processed for sending feedback forms after the event’s completion. f/ Recording and Participation in Workshops: If specific workshops are organized for an event, personal data will be processed for registration and participation purposes. g/ Marketing Purposes: You may receive marketing communications from the Administrator, but only for events of a similar nature.
Legal Basis	The processing of personal data under point d/, e/ and g/ is carried out on the basis of legitimate interest. The processing of personal data under point a/ is carried out for the purpose of concluding a contract, and the personal data under point b/, c/ and f/  for the purpose of performing the ticket sales contract, of which the data subject is a party. In case you have additionally and optionally provided consent in a separate checkbox (on the ticket.bg, eventim.bg, or other intermediary websites), only then the Administrator may provide personal data (email and name) to third parties/companies in the EU or EEA for the purpose of those companies sending you marketing messages or conducting statistical surveys.
Data We Process	The categories of personal data processed include: Phone number Photos Videos Names Email address Company and position Shipping address (for courier delivery) Password
Categories of Recipients (Optional)	PR/Marketing agencies, photographers, and/or other individuals who may be engaged in covering events related to this; Government authorities – when we have a legal obligation in some cases to provide information; In cases of explicit consent on the intermediary company websites when purchasing tickets – to third parties/companies, so that they can send you marketing messages or conduct statistical surveys.
Retention Period	We will retain your data for the following periods: 3 years from the event coverage/publication on the Administrator's website. 1 year and 6 months for sending messages about similar events to the one for which the ticket was purchased. 6 years for evidentiary purposes to demonstrate that the Administrator has informed the individual about this Privacy Notice through digital means. For workshop registration and participation – until the event is completed. For the performance of the ticket purchase agreement – until the event is completed, and an additional 11 years for tax and accounting legal requirements (e.g., invoicing, payments, etc.). For third-party marketing purposes – according to the policies of these third parties/companies, but no longer than 6 months.
Data Subject Rights	You can request from us, as the administrator, access to, correction, or deletion of your personal data, or restriction of the processing of your personal data related to you. You have the right to object to the processing, as well as the right to data portability. We will ensure that your requests to exercise your rights are reviewed within the timeframes set forth by the Personal Data Protection Act and Regulation 2016/679. Please note that your requests to exercise your rights and their fulfillment will be subject to the provisions of Regulation 2016/679 and the Personal Data Protection Act.
Exercise of Rights	You can exercise your rights electronically (via email) to the email address provided above in this notice and/or by sending us a letter and/or by submitting your request directly to us.  Please note that when the request is made remotely, we may ask for additional identification information to ensure that it is truly you who wishes to exercise your rights and not a third party acting in bad faith.
Right to Complain	You have the right to file a complaint regarding the processing of your personal data by us with the relevant supervisory authority. To avoid any doubt, the supervisory authority is the Commission for Personal Data Protection ( www.cpdp.bg). Without prejudice to your right to file a complaint, we are available to discuss any concerns you may have if you believe that your rights regarding the processing of your personal data have been violated.
Right to Object	You have the right to object to the processing of your personal data based on legitimate interest through the contact details of the Data Protection Officer at the Administrator.
Obligation to Provide Data	The provision of your personal data is mandatory for registration or for requesting the purchase of a ticket for an event organized by the Administrator.
Data Transfer	Your personal data will not be transferred to countries outside the European Union or the European Economic Area.
Automated Decision-Making	You will not be subject to automated decision-making.