BARBOSA OOD - a company registered on the territory of the Republic of Bulgaria, with headquarters and management address: Burgas, 47 Khan Krum St. EIC: BG204263545, phone: 0879820202 and email: barbossabar@gmail.com

In connection with its activity - offering non-alcoholic and alcoholic beverages - the "Company" processes data, some of which are personal data, according to the Personal Data Protection Act and Regulation (EU) 2016/679, therefore it has the status of personal data administrator .
This policy aims to inform the users of https://barbossabar.com/bg/ about the way in which their personal data is processed, about their rights, the methods of personal data protection used by the administrator, to whom the Company has the right to provide the collected personal data as well as the methods of exercising the rights of the data subjects.

Objectives and scope of the policy:
With this Personal Data Protection Policy, BARBOSA Ltd. takes into account the confidentiality and privacy of personal data. In accordance with legislation and good practices, the Company implements the required technical and organizational measures to protect the personal data of natural persons.

With this Personal Data Protection Policy, the Company aims to inform natural persons about the purposes of personal data processing, the recipients or categories of recipients to whom the data may be disclosed, the mandatory or voluntary nature of providing the data and the consequences of refusing to provide them , information on the right to access and correct the collected data.

Basic terms and definitions:
"personal data" means any information relating to an identified natural person or an identifiable natural person ("data subject"); an identifiable natural person is a person who can be identified, directly or indirectly, in particular by an identifier such as a name, an identification number, location data, an online identifier or by one or more characteristics specific to the physical, the physiological, genetic, psychic, mental, economic, cultural or social identity of that natural person;

"processing" means any operation or set of operations performed on personal data or a set of personal data by automatic or other means such as collection, recording, organization, structuring, storage, adaptation or modification, retrieval, consultation, use, disclosure by transmission, distribution or other way in which the data is made available, arranged or combined, restricted, deleted or destroyed;

"restriction of processing" means the marking of stored personal data in order to restrict their processing in the future;

"profiling" means any form of automated processing of personal data consisting in the use of personal data to assess certain personal aspects related to a natural person, and more specifically to analyze or predict aspects related to the performance of professional duties that individual's economic status, health, personal preferences, interests, reliability, conduct, location or movement;

"administrator" means a natural or legal person, public body, agency or other structure that alone or jointly with others determines the purposes and means of processing personal data; where the purposes and means of this processing are determined by Union law or the law of a Member State, the controller or the special criteria for its determination may be established in Union law or in the law of a Member State;

"processor of personal data" means a natural or legal person, public body, agency or other structure that processes personal data on behalf of the controller;

"recipient" means a natural or legal person, public body, agency or other structure to which the personal data is disclosed, whether or not it is a third party. At the same time, public authorities that may receive personal data within the framework of a specific investigation in accordance with Union law or the law of a 4.5.2016 L 119/33 Official Journal of the European Union BG Member State are not considered "recipients"; the processing of this data by the specified public authorities complies with the applicable data protection rules in accordance with the purposes of the processing;

"third party" means a natural or legal person, public body, agency or other body other than the data subject, the controller, the personal data processor and the persons who, under the direct supervision of the controller or the personal data processor, have the right to process the personal data;

"data subject consent" means any freely expressed, specific, informed and unequivocal indication of the will of the data subject, by means of a statement or clear affirmative action, which expresses his consent to the personal data relating to him being processed;
All quoted terms and definitions are in accordance with the legal definitions given by Regulation 2016/679 (the Regulation).

Principles of personal data processing applied by the Company:
personal data is processed lawfully, in good faith and transparently;
specific purposes for data processing are necessary;
data minimization;
limitation of time storage of personal data;
ensuring the security of personal data.

Purposes and basis for processing personal data:

The main reason for collecting personal data is direct marketing. The company collects personal data for marketing and advertising purposes. The data is collected only and only with the express free, clear and informed consent of the user, which he noted when reading this policy for the protection of personal data. Any individual who has given his consent to be subject to the Company's direct marketing, has the opportunity at any time to withdraw his consent, in an easy and convenient way, in accordance with the principle of transparency, laid down as a basic principle in the Regulation.

The Company processes personal data only when:
has received clear, free, informed and unequivocal consent from data subjects who are aware in advance what their personal data will be used for with this policy;

when there is a contractual obligation, in order to fulfill a contract, one party being the natural person (when the Company processes data of its workers/employees) and for the exercise, establishment and protection of rights and legal interests;

where the processing is necessary for the performance of a task carried out in the public interest (under EU or national law);

has received express consent from the individual, for the purpose of direct marketing (e.g. sending email advertising).

Data collected and processed:
Important: Barbosa Ltd. does not collect or process sensitive personal data of its customers and users.

The data collected and processed are:
Name and surname of the user - for the purpose of identifying the subject when requesting a service;
Email address - for quick and easy correspondence;
Telephone number - for direct contact with the data subject;
Delivery address (only in case of delivery expressly requested by the user);
Others, admissible under the Regulation, if necessary to fulfill an obligation of the Company or related to a certain service.
The sender of personal data has the right not to share any personal data requested of him. In cases where these personal data are necessary for the performance of a specific service, a specific specialized function or an effective response to a given inquiry (excluding direct marketing) - e.g. delivery to a certain address, BARBOSA OOD would not be able to fulfill the request, due to lack of data, of which the user is explicitly notified, through the personal data policy.

When, in connection with the Company's activity, it is necessary to process or store data of persons under the age of 18, this is done with the express consent of the parent/guardian.

Recipients of personal data:
The Company has the right and the obligation to provide the personal data of the data subjects to certain state institutions in order to comply with the Bulgarian legislation, namely: in connection with the data collected by the workers/employees of the Company - National Revenue Agency, National Insurance Institute, Agency for Employment etc. Data may be provided to accounting houses, banking organizations, HR agencies and mobile operators;

The company has the right to provide the data of individuals to hospitals, judicial and investigative bodies;

The personal data of the users of www.barbossabar.com are not provided to third parties outside the scope of their expressed consent or the requirements of the law.

The company does not share data of individuals with organizations outside the European Union.

Period of storage of personal data:
Barbosa Ltd. has shortened the storage period of personal data to a minimum. The Company destroys the data as soon as the purpose for which it was collected is fulfilled, unless the same is necessary for the performance of a task in the public interest or related to the exercise of official powers granted to the controllers of personal data under Union law or according to the law of a member state, as well as in relation to the requirement of Bulgarian legislation;

Data Protection Officer
Due to the fact that the Company processes and stores personal data of a large number of persons (customers and users of www.barbossabar.com) "Barbosa" Ltd. uses the services of a data protection official who is responsible for the correct application of the Regulation (EU ) 2016/679 and protecting the rights of data subjects;

User rights:
Users' right of access to the data concerning them;
Right to rectification;
Right to object to data processing;
Right to erasure (right to be forgotten);
Right to restriction of processing;
Right to data portability;
Right to withdraw consent at any time, without prejudice to the lawfulness of processing based on consent that was given before it was withdrawn.
When personal data are processed for the purposes of direct marketing, the user has the right to object at any time to the processing of personal data concerning him for this type of marketing. The user is notified in advance of the existence of the right to object, which is granted to him, by notification in a clear way and separately from any other information.

Policy Changes:
The Company has the right to update, amend and supplement the personal data protection policy at any time in the future, when the circumstances require it.

Contact details of the personal data controller:
Address: Gr. Burgas, Serdika St. 25
official contact phone number: 0879820202
e-mail: barbossabar@gmail.com

Data Protection Supervisory Authority
The data protection supervisory authority at national level is the Personal Data Protection Commission. It monitors the correct implementation of Regulation (EU) 2016/679, and any natural person who believes that their rights have been violated in relation to the processing of their personal data can submit a complaint to the Commission at the following address:

City. Burgas, Serdika St. 25
phone: 0879820202
e-mail: barbossabar@gmail.com
Website: https://barbossabar.com/en/