Personal Data Protection Policy

This personal data protection policy is intended to inform the clients and visitors of crediport.bg (hereinafter also the Website), as data subjects, of how the insurance broker CREDIPORT INS EOOD (hereinafter the Controller), company number (UIC) 201804636, with its registered office and management address at 84 Ami Boué St, 9th floor, Sofia 1612, uses, stores and protects the personal data they provide when using the services offered on the Website. This policy is an integral part of the General Terms of use of the website at crediport.bg, for insurance intermediation services at a distance, including concluding insurance contracts at a distance and making payments, which you can find here, and of the Cookie Policy, which you can read here.

This policy aims to set out as clearly and simply as possible what personal data we process and for what purpose, how long the data will be processed, to whom the personal data will be provided, and the rights of users as data subjects and how they can contact us or the competent supervisory authority.

MANDATORY INFORMATION ON THE RIGHTS OF INDIVIDUALS WHEN PERSONAL DATA ARE PROCESSED

1. Information about the company that is the Data Controller.

CREDIPORT INS EOOD, UIC 201804636, is an insurance broker with its registered office and management address at 84 Ami Boué St, 9th floor, Sofia 1612, email: office@crediport.bg, phone: (0894) 421 161

2. Information about the competent state data protection authority.

Commission for Personal Data Protection, address: 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592

Phone: 02/91-53-519

Website: www.cpdp.bg

3. Types of data subjects. Categories of data processed. Purposes of processing and retention period.

Depending on how people use the Website, they can be divided into different groups, and for each of them the processing of personal data may involve different categories of data, purposes and grounds, retention periods, protection measures and so on.

The same person may fall into more than one of the groups listed at the same time (for example, every User of an insurance service is also a Visitor).

3.1 Visitors.

A Visitor is anyone who loads the Website in their web browser (whether by typing the address directly into the browser or via a link from another website or resource).

Categories of data that may be processed:

• • online identifiers stored in local cookies on the Visitor’s device/browser;
  • location data provided by the visitor;
  • country/city data based on the IP address of the user’s device, which is an inherent part of the information every website receives;
  • information about actions taken by the data subject on the Website;
  • the data subject’s preferences regarding specific aspects and settings of the Website’s functions;
  • information about the type of browser/device used.

Purposes of processing:

• • providing the core and auxiliary functions needed for the proper and full functioning of the Website;
  • counting visits to the Website;
  • providing the conditions needed to apply the services of marketing platforms.

Retention period:

Until each cookie carrying the information expires (up to 1 year from when it was stored), or until the data subject on whose device/browser it is stored deletes it.

Legal basis for the processing:

The explicit and freely given consent of the data subject, given when the Website loads.

3.2 User.

A User is an adult natural person who, using the functionality provided on the Website, wishes to entrust the performance of insurance intermediation at a distance and/or to conclude an insurance contract at a distance, including paying the insurance premium due.

Categories of data that may be processed:

• • full name, personal identification number (EGN), permanent address, phone number, email;
  • bank account number;
  • data from an identity document;
  • depending on the type of insurance, personal data may be needed relating to: the person’s civil status, job/profession, vehicle registration number, state of health and other data relating to the subject of the specific type of insurance.

Purposes of processing:

Concluding an insurance intermediation contract and concluding an insurance contract.

Retention period:

Up to five years after the end of the insurance intermediation contract and/or the insurance contract. If some of the data are needed for tax purposes, they will be kept for 10 years from 1 January of the year following the year the contract was concluded.

Legal basis for the processing:

The explicit and freely given consent, and the conclusion of an insurance intermediation contract through the Website and for taking steps to conclude an insurance contract through the Website.

3.3 Third parties other than the user.

A third party other than the user is a natural person whose data are needed in connection with the subject of the insurance contract the User wishes to conclude.

Categories of data that may be processed:

• • full name, EGN, permanent address, phone number, email;
  • bank account number;
  • data from an identity document;
  • depending on the type of insurance, personal data may be needed relating to: the person’s civil status, job/profession, state of health and other data relating to the subject of the specific type of insurance.

Purposes of processing: concluding an insurance contract.

Retention period:

Up to five years after the end of the insurance intermediation contract and/or the insurance contract. If some of the data are needed for tax purposes, they will be kept for 10 years from 1 January of the year following the year the contract was concluded.

Legal basis for the processing:

The User’s legal obligation to take out the relevant insurance, or the explicit and freely given consent of the data subject for taking steps to conclude an insurance contract through the Website.

The user’s obligation when providing data of third parties:

By accepting this Personal Data Protection Policy, the User declares that they have obtained the third party’s express consent for their personal data to be provided to the Controller for the purpose of concluding the insurance contract the User has chosen.

4. Rights of data subjects.

Every person whose personal data are processed has the rights listed below, which they can exercise by contacting the Controller at the contact details given above for the data controller, or through the Contact menu on the Website.

4.1 Right of access to personal data.

The data subject has the right to obtain confirmation from the Controller of whether personal data about them are being processed and, if so, access to the personal data and information.

When the information requested is manifestly unfounded or excessive, the data controller may refuse access or charge the data subject a fee equal to the administrative costs of providing the information. Whether a request is justified is assessed case by case; any refusal is reasoned, and the data subject is informed of the possibility of lodging a complaint with the Commission for Personal Data Protection.

4.2 Right to rectification of personal data.

The data subject may at any time request that inaccurate or incomplete personal data be corrected.

4.3 Right to erasure of personal data (the “right to be forgotten”).

The data subject has the right to ask the Controller to erase some or all of the personal data relating to them, and the Controller must erase them without undue delay if any of the following grounds applies:

• • the personal data are no longer needed for the purposes for which they were collected;
  • the data subject withdraws the consent on which the processing is based and there is no other legal basis for it;
  • the data subject objects to the processing and there is no other overriding legal basis for it;
  • the data subject objects to processing for direct marketing purposes;
  • the personal data have been processed unlawfully;
  • the personal data must be erased to comply with a legal obligation of the data controller;
  • The data controller may be released from this obligation if it stores and processes personal data:
  • to comply with a legal obligation requiring processing under EU or Member State law that applies to the Controller, or to perform a task in the public interest or in the exercise of official authority vested in it;
  • for the establishment, exercise or defence of legal claims.

4.4 Right to restriction of processing.

The data subject has the right to ask the Controller to restrict the processing of their personal data where:

• • the data subject contests the accuracy of the personal data; the restriction applies for a period that allows us to verify the accuracy of the data;
  • the processing is unlawful, but the data subject does not want the personal data erased and requests restriction of their use instead;
  • we no longer need the personal data for the purposes of processing, but the data subject requires them for the establishment, exercise or defence of legal claims;
  • the data subject has objected to processing based on our legitimate interest, and it is being checked whether the controller’s legitimate grounds override the data subject’s interests.
  • We may process personal data whose processing is restricted only for the following purposes:
  • for storing the data
  • with the data subject’s consent;
  • for the establishment, exercise or defence of legal claims;
  • to protect the rights of another natural person; or
  • for important reasons of public interest.
  • When a data subject has requested restriction of processing and one of the grounds above applies, we inform them before the restriction is lifted.

4.5 Right to object to processing.

In certain circumstances, for example if the data subject doubts the Controller’s legitimate interest in processing their personal data, they have the right to object to such processing on grounds relating to their particular situation. When such an objection is made, we must stop processing unless there are compelling legitimate grounds that entitle us to continue and that override the interests, rights and freedoms of the data subject, or the processing is for the establishment, exercise or defence of legal claims.

When personal data are processed for direct marketing, the data subject has the right to object to such processing at any time, and we must stop processing for that purpose immediately.

4.6 Right to data portability.

If personal data are processed by automated means with the consent of the data subject or for the performance of a contract, they have the right to ask us to provide their personal data in a machine-readable format for transfer to another data controller.

4.7 Right to lodge a complaint with a supervisory authority.

If their rights are infringed in connection with the processing of their personal data, the data subject has the right to lodge a complaint with the Commission for Personal Data Protection. The complaint can be submitted on paper or sent by post to: 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592. It can also be submitted by email to: kzld@cpdp.bg.

5. Procedure for exercising the rights of data subjects.

To exercise the rights described above, the data subject can send a request:

• • electronically, at the following email address: office@crediport.bg;
  • by post to the management address: 84 Ami Boué St, 9th floor, Sofia 1612; or
  • in person at the data controller’s office: 84 Ami Boué St, 9th floor, Sofia 1612.
  • The request is made in free text and must contain information from which the person can be identified, as well as contact details for a reply.

6. Disclosure of personal data to third parties.

By accepting the Website’s general terms, the data subject gives express consent for us to provide their personal data to the insurer they have chosen to conclude an insurance contract with. The Controller does not provide personal data to third parties other than those already mentioned, except in the following cases:

• • where there is a legal obligation to disclose or share data;
  • where the data subject concerned has given consent.

7. Data of minors.

If the data subject is a minor, they may not use the services of the Website. If they use the Website anyway, they are hiding important information from us and misleading us. In that case the Controller is not liable for any circumstances or events arising as a result of being misled by the data subject.

As data Controller, we do not collect personal information from minors that could lead to their identification.