Privacy Policy
Information about the company processing your data:
- Name: "BIKE MOTION" LTD
- EIK: 208641985
- Registered office, management address and correspondence address: Smolyan 4700, 26 Kiril Madzharov St.
- E-mail: bikemotionbg@gmail.com
- Website: www.bikemotion.bg
Information about the competent supervisory authority for personal data protection:
- Name: Commission for Personal Data Protection
- Registered office, management address and correspondence address: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.
- Phone: 02 915 3 518
- Website: www.cpdp.bg
"BIKE MOTION" LTD (hereinafter referred to as "Administrator" or "Company") carries out its activities in accordance with the Personal Data Protection Act and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, on the protection of individuals with regard to the processing of personal data and on the free movement of such data. This information is intended to inform you about all aspects of the processing of your personal data by the Company and the rights you have in connection with this processing.
I. Grounds for collecting, processing and storing your personal data
Art. 1. The Administrator collects and processes your personal data in connection with the use of the website www.bikemotion.bg, the conclusion and performance of contracts with the Company and specifically on the following grounds under Art. 6, para. 1, Regulation (EU) 2016/679 (GDPR):
- Explicit consent received from you as a customer;
- Performance of the Administrator's obligations under a contract with you;
- Compliance with a legal obligation that applies to the Administrator;
- For the purposes of the legitimate interests of the Administrator or a third party.
II. Purposes and principles in the collection, processing and storage of your personal data
Art. 2. (1) We collect and process the personal data that you provide to us in connection with the use of the website www.bikemotion.bg and the conclusion of a contract with the Company, including for the following purposes:
- creating a profile and providing full functionality when using the site;
- making reservations;
- individualization of a party to the contract;
- accounting purposes;
- statistical purposes;
- protection of information security;
- ensuring the performance of the contract for the provision of the respective service;
- participation in events organized by the Company, with given explicit consent;
- participation in conducting games, sweepstakes, advertising campaigns with your given explicit consent;
- participation in customer loyalty programs organized by the Company, with your given explicit consent;
- sending an information bulletin /newsletter/ with your given explicit consent;
- getting acquainted with promotional conditions and sending any other type of commercial messages, with your given explicit consent.
(2) We observe the following principles in the processing of your personal data:
- lawfulness, fairness and transparency;
- purpose limitation;
- data minimization and relevance to processing purposes;
- accuracy and timeliness of data;
- storage limitation in view of achieving the purposes;
- integrity and confidentiality of processing and ensuring an appropriate level of security of personal data.
(3) In the processing and storage of personal data, the Administrator may process and store personal data with the aim of protecting the following legitimate interests:
- performance of obligations to the National Revenue Agency, the Ministry of Internal Affairs and other state and municipal authorities.
III. What types of personal data our company collects, processes and stores
Art. 3. The Company performs the following operations with the personal data provided by you for the following purposes:
- Conclusion and performance of a commercial transaction or contract with a customer – the purpose of this operation is the conclusion and performance of a contract with a commercial partner or customer and its administration. In separate cases, the purpose of the operation can also be the protection of the legal interests of the Company for the execution of the transaction.
- User registration on the website and performance of a contract for tourist services – the purpose of this operation is to create a profile for using the website for booking and concluding contracts for tourist services and receiving newsletters when desired. Providing contact data for performing delivery of purchased services.
- Sending an information bulletin (newsletter) – the purpose of this operation is to administer the process of sending bulletins to customers who have given explicit consent to receive them.
- Exercising the right of withdrawal or making a complaint – the purpose of this operation is to administer the process of delivering purchased services to customers.
- Registration of a participant in events and sending information or prizes – the purpose of this operation is to administer the process of registering participants in events and games with their given explicit consent for this, and sending prizes from conducted games.
Art. 4. (1) The Administrator processes the following categories of personal data and information for the following purposes and on the following grounds:
Registration data (as a customer – names, e-mail, phone, address; as a guest – names, e-mail)
Purpose: 1. Establishing contact with the user and sending information, with explicit consent; 2. user registration; 3. potential possibility for concluding a contract; 4. for sending a newsletter, with explicit consent.
Grounds: By accepting the general terms and conditions and registering on the website or placing an order without registration, or upon conclusion of a written contract, a contractual relationship is created – Art. 6, para. 1, (b) GDPR. Newsletter data is processed based on consent – Art. 6, para. 1, (a) GDPR.
Data for receiving newsletters and other commercial messages (names, phone, e-mail)
Purpose: For direct marketing – sending newsletters and commercial messages.
Grounds: Data is processed based on explicit consent provided by you – Art. 6, para. 1, (a) GDPR.
Data for making delivery (names, ID number, phone, e-mail, address; data for used means of payment)
Purpose: Performance of the administrator's obligations under a distance purchase contract and delivery of purchased services, including when exercising the right of return, exchange or withdrawal.
Grounds: By accepting the general terms and conditions and registering or placing an order without registration, a contractual relationship is created – Art. 6, para. 1, (b) GDPR.
Data from your profiles in social networks (publicly available information from Google+, Facebook, Instagram)
Purpose: 1. Establishing contact with the user and sending information; 2. For the purposes of registration to participate in a game, sweepstake, campaign, etc.
Grounds: Data is processed based on explicit consent provided by you – Art. 6, para. 1, (a) GDPR.
(2) The Administrator does not collect and does not process personal data that relate to the following:
- reveal racial or ethnic origin;
- reveal political, religious or philosophical beliefs, or trade union membership;
- genetic and biometric data, data about health condition or data about sexual life or sexual orientation.
(3) Personal data are collected by the Administrator from the persons to whom they relate.
(4) The Company does not perform automated decision-making with data.
(5) The Company does not collect and does not process data for persons under 16 years of age.
IV. Video recording and use of images
Art. 5. (1) Within the framework of the organized travel packages, the Administrator may perform photographic and/or video recording of the participants. In this case, the following personal data can be processed:
- image (video and photos);
- voice;
- behavior during the tour.
(2) Recording is performed for the purpose of:
- creating a memory for the participants;
- providing video materials to the participants;
- promoting the activities of 'Bike Motion' through: the official website; social networks (Facebook, Instagram, YouTube, etc.); advertising and marketing materials.
(3) The legal ground for processing is Art. 6, para. 1, (a) of Regulation (EU) 2016/679 (GDPR) – explicit consent of the data subject. Recording and use of images is performed only after signing a separate consent declaration.
(4) Providing consent is entirely voluntary. Refusal to be recorded or to have images used does not in any way affect the right to participate in the travel package.
(5) For participants under 18 years of age, consent is provided by a parent or legal representative.
V. Period of storage of your personal data
Art. 5. (1) The Administrator stores your personal data for a period no longer than 10 years from your last activity or until withdrawal of your consent, respectively submission of a request by you to restrict the processing of your data. After deletion of your profile or successful completion, the Administrator takes the necessary steps to delete and destroy all your data without undue delay.
(2) The Administrator stores your personal data provided in connection with online orders for a period of 10 years for the purposes of protecting the legal interests of the Administrator in judicial or administrative disputes with users, while accounting documents are also stored for the legally established 10-year period.
Art. 6. The Administrator stores personal data of the legal representatives of their commercial partners for the period of performance of the contract, for compliance with the legitimate interests and legal obligations of the Administrator, and this period may exceed the term of the concluded contract.
VI. Transfer of your personal data for processing
Art. 7. (1) The Administrator may, at its own discretion, transfer part or all of your personal data to persons processing personal data on behalf of the Administrator for the fulfillment of the processing purposes to which you have consented, in compliance with the requirements of Regulation (EU) 2016/679 (GDPR).
(2) The Administrator does not transfer personal data to third countries or international organizations.
VII. Your rights in the collection, processing and storage of your personal data
Art. 8. In the collection, processing and storage of your personal data, the Administrator ensures you the possibility to exercise the following rights:
1. Withdrawal of consent for processing of your personal data
Art. 8. (1) If you do not want all or part of your personal data to continue to be processed by the Company for a specific or for all purposes of processing, you can at any time withdraw your consent for processing through the form in your profile or through a request in free text.
(2) The Administrator may request that you verify your identity before a company employee.
(3) Upon withdrawal of consent for data mandatory for the site profile, your account will become inactive. You will be able to browse the site and place orders as a guest or register again.
(4) If there is an order placed that is being processed, the earliest moment you can withdraw consent is upon successful completion of the order.
2. Right of access
Art. 9. (1) You have the right to request and receive from the Administrator confirmation whether personal data related to you are processed. As a registered user, you can view your data at any time in your profile.
(2) You have the right of access to the data related to you and the information about their collection, processing and storage.
(3) The Administrator provides upon request a copy of the processed data in electronic or other appropriate form.
(4) Access is provided free of charge, but the Administrator may impose an administrative fee in case of repetitiveness or excessiveness of requests.
3. Right to rectification or completion
Art. 10. You can correct or complete inaccurate or incomplete personal data related to you directly through your profile on the website or by submitting a request to the Administrator.
4. Right to erasure (right 'to be forgotten')
Art. 11. (1) You have the right to request erasure of personal data related to you when: the data are no longer necessary; you withdraw your consent; you object to processing; the data have been processed unlawfully; or erasure is necessary for compliance with a legal obligation.
(2) The Administrator is not obliged to erase data if it stores them for compliance with a legal obligation, public interest or for the establishment and protection of legal claims.
(3) Upon exercising the right to be forgotten, the Company deletes all your data, with the exception of information necessary to verify fulfillment, technical information that cannot be linked to your identity, and the registration email.
(4) The Administrator does not delete data that it has a legal obligation to store.
5. Right to restriction of processing
Art. 12. You have the right to request from the Administrator restriction of the processing of data related to you when: you contest the accuracy of the data; processing is unlawful but you do not want deletion; the Administrator no longer needs the data but you require them for legal claims; or you have objected to processing pending verification.
6. Right to data portability
Art. 13. (1) You can at any time download or receive in machine-readable format the data stored and processed about you, directly through your profile via the data export option or by emailing a request.
(2) You can request from the Administrator to directly transfer your personal data to another administrator designated by you, when this is technically feasible.
7. Right to receive information
Art. 14. You can request from the Administrator to inform you about all recipients to whom personal data, for which rectification, erasure or restriction of processing was requested, have been disclosed. The Administrator may refuse to provide this information if it would be impossible or require disproportionately large efforts.
8. Right to object
Art. 15. You can at any time object against the processing of personal data by the Administrator relating to you, including if they are processed for the purposes of profiling or direct marketing.
9. Your rights in case of a personal data security breach
Art. 16. (1) If the Administrator establishes a breach of the security of your personal data that may give rise to a high risk to your rights and freedoms, it notifies you without undue delay of the breach and of the measures taken or to be taken.
(2) The Administrator is not obliged to notify you if: it has taken appropriate technical and organizational protective measures; it has subsequently taken measures ensuring that the breach will not result in a high risk to your rights; or notification would require disproportionate effort.
VIII. Persons to whom your personal data are provided
Art. 17. For the purposes of processing your personal data and providing the service in its full functionality and in view of your interests, the Administrator may provide your data to the following persons, with whom data processing contracts have been concluded:
| Обработващ | Цел |
|---|---|
| "SUPERHOSTING" Ltd | Hosting for the site |
| Direct marketing platforms | SMS campaigns and newsletter distribution |
| Distributors and partners | Distribution with intermediary services |
The aforementioned persons processing personal data comply with all requirements for lawfulness and security in the processing and storage of your personal data.
Art. 18. In case of violation of your rights under the above or the applicable personal data protection legislation, you have the right to file a complaint with the Commission for Personal Data Protection.
IX. Declaration-consent for personal data processing
As a subject of personal data and under the conditions of the General Data Protection Regulation, I agree that I provide my personal data (namely full name, ID number, phone, email address and height – in case of rental of an electric bicycle) to the administrator 'Bike Motion' Ltd.
I agree that my personal data will be stored and processed for the performance of a contract or ordered service and for receiving messages about new products and promotions, invitations to participate in games and other events.
I am aware that my personal data will be processed by the Administrator for the period necessary for the performance of the pre-contractual or contractual relationship between me and 'BIKE MOTION' LTD, and thereafter for the shorter of: 1) the storage period for contractual documents prescribed by the tax and accounting legislation of the Republic of Bulgaria or 2) the period of 10 years.
I am informed that I can withdraw my consent at any time, after which my personal data will be deleted. I am informed that my request may not be satisfied if it conflicts with the fulfillment of legal obligations of the administrator or the public interest. I am aware that the later withdrawal of my consent will not affect the lawfulness of the processing based on the consent given now.
I declare that I will notify the Administrator in writing of any change in my personal data during the processing period.
I am aware that the Privacy Policy, containing all aspects of the processing of my personal data by the Administrator and the rights I have in connection with this processing, is published on the Administrator's website www.bikemotion.bg.