PRIVACY POLICY ON PERSONAL DATA PROTECTION AND PROCESSING 

OF

„VIRGINIA RECORDS” LTD AND AFFILIATED COMPANIES: „MUSIC MALL” LTD, „VIRGINIA PUBLISHING“ LTD, „ANIMATO MUSIC“ LTD, „ANIMATO MUSIC PUBLISHING“ LTD AND „VIRGINIA REAL ESTATE“ LTD,

Hereinafter all referred to as companies of „Virginia Records“ group or companies of the group/administrator

TYPES OF PERSONAL DATA COLLECTED AND PROCESSED 

1. Depending on the type of contractors of the companies of „Virginia Records” Group – if they are authors, performers, clients, customers, suppliers, business partners and etc., and how they interact with the group – in person, via internet, telephone and other communication devices, different types of personal data are processed, as follows:

• When the contractors sign authors, producers, performers, management, license or other type of contract/declaration in the copyright and related rights area,
• When they buy or use products and services;
• When they provide goods and services;
• When they participate in events, organized by „Virginia Records” or companies of the group;
• When they interact with companies of the „Virginia Records” group in other ways.

2. The types of data that may be collected from the information, provided by the contractors, are the following:

For the sake of security, data via electronic devices or surveillance system can be recorded when visiting the offices of companies of the „Virginia Records” group.

For contractors, communicating via computer systems in certain cases a record is created, which includes for example Internet Protocol (IP) address, used for connecting the computer in Internet, email, log-in, password, information about the contractor’s computer and about the methods of connection, such as the type of the browser and the version of the operational system; data, time (including the date and time), as well as any phone number used for connection; in case of bank card payment – the required card information for making the transaction.

USE OF PERSONAL DATA

It is possible personal data to be used for different reasons and for different purposes permitted by law.

The collected personal data will be used only for the following purposes:

In case of denial for disclosing the minimum required data, we will not be able to provide all products, entire services or part of them. It is possible that we will not be able to satisfy eventual claims and orders, or there may be procedures opened which si out of our control.

USE OF PERSONAL DATA FOR MARKETING PURPOSES

It is possible that the companies from „Virginia Records” group will send to their contractors promotional messages for their products, services, events and promotions.

Such promotional messages can be send via courier, email, phone, mail, social media.

When this is required by the legislation, the contractors’ consent will be requested in advance with the possibility for its withdrawal at any time.

LEGAL GROUNDS FOR USE/PROCESSING OF PERSONAL DATA

There are various grounds for processing of personal data, such as:

• Contractor’s consent.
• The necessity of creating contract relation with the contractor or for the purpose of fulfillment of our obligations under a signed contract;
• The necessity of fulfillment of legal obligations and for establishment of rights when initiating legal proceedings or defending against legal claims;
• The necessity to follow legitimate interests of “Virginia Records” or the companies of „Virginia Records” group, including:
• Securing protection of networks and information;
• Administration and conducting of the usual activity in the scope of „Virginia Records” LTD and the companies of the „Virginia Records” group;
• Prevention or investigation of alleged or actual violations of the legislation, breaches of contracts, incl. with performers, authors, clients or other, policies of „Virginia Records” LTD or the companies of „Virginia Records” group.
• The necessity to respond to the requirements of the contractors;
• The necessity to protect vital interests of certain individual/individuals;
• Retaining and increasing the number of loyal contractors;
• Developing and optimize the realization of our goods and services;
• Keeping of reports and statistics of our activity and preparing analyses with regard to our activity;
• Every other legal ground, permitted by the applicable law.

PERSONAL DATA PROTECTION

To ensure adequate protection of the company’s data and the data of the companies of the group and the data of their clients and counteragents all necessary organizational and technical measures under the applicable law are implied.

„Virginia Records” and the companies of the group have established divisions and responsible persons for prevention of abuses and security breaches. A Personal Data Protection Officer has been appointed, with the purpose to support the processes and to ensure the security of personal data.

For the purpose of maximum security in processing, transfer and storing of personal data, additional mechanisms are used for protection such as pseudonymisation and etc.

PERIOD FOR WHICH THE PERSONAL DATA ARE STORED

The personal data are stored for a period, necessary for fulfilling the purposes, for which they are collected, including the period of the signed contracts and the rights granted for use. In certain cases under the law, longer storage period could be required or permitted. The criteria used for determination of the storage periods include:

• For what period of time the personal data is necessary for the relevant services and activities;
• Do we have a legal, contractual or other similar obligation to keep the data, including but not limited, as a legislative requirement, orders from government authorities to keep data, connected with investigation, or data, which have to be stored for the purposes of court disputes.
• The use of the personal data for the purposes, connected with the contractual relation, must be terminated after the termination of the contract as a general rule, but they are erased after:

• 6 (six) years since the termination of the contract or the final settlement of every financial obligations and expiration of legal obligations for data protection;
• Obligations under the Bulgarian Accountancy Act for storage and processing of accounting data;
• The prescription periods set in the Bulgarian Law on Obligations and Contracts for claims, obligations for providing information to the court, competent government authorities and other grounds, stipulated in the legislation.

Personal data will not be erased or rendered anonymous if they are necessary for pending court proceedings, administrative proceedings or complaint proceedings before the Administrator.

The personal data could be rendered anonymous. This is an alternative of the deletion of the data. When rendered anonymous, all personal recognizable elements, allowing the identification of the person, are deleted irreversibly. For anonymous data there is no legal requirement for deletion because they are not personal data anymore.

DISCLOSING PERSONAL DATA TO A COUNTRY OUTSIDE THE EU OR TO AN INTERNATIONAL ORGANIZATION  

Personal data, processed by the companies of the „Virginia Records” group are not subject to third person deals for benefits acquisition. The data can be disclosed to service subcontractors, which have signed a contract with a company from „Virginia Records” group, such as:

– Information-technological service providers: with regard to some of the processes of processing the data, such as their storage and security, „Virginia Records” LTD  and the companies of the group use third persons services, processing the data in accordance with the instructions and under the supervision of „Virginia Records” LTD/the companies of the group. These third persons are established in the EU.

– Legal services providers – „Virginia Records” LTD and the companies of the group use third persons services – legal services providers in case of disputes with deliveries and other. The legal services providers process the data in accordance with the instructions and under the control of „Virginia Records” LTD/the companies of the group. These third persons are established in the EU.

– Accounting and audit service providers – „Virginia Records” LTD and the companies of the group use third persons services – accountants and auditors in accounting the deliveries, invoicing, declaring, and etc. The accounting and audit service providers process the data, in accordance with the instructions and under the control of „Virginia Records” LTD/the companies of the group. These third persons are established in the EU.

– The companies of „Virginia Records” LTD group – „MUSIC MALL” LTD, „VIRGINIA PUBLISHING“ LTD, „ANIMATO MUSIC“ LTD, „ANIMATO MUSIC PUBLISHING“ LTD AND „VIRGINIA REAL ESTATE“ LTD: with regard to the legitimate interest of the group to conduct common marketing and commercial activity.

– Courier and postal services: in case of deliveries „Virginia Records” LTD and the companies from the group disclose to the courier and postal services providers the name, phone and address of the delivery, which will be conducted, only for the purposes of the delivery and its accounting (without any other personal information).

All third parties which may receive the data, are obliged to keep them in a secured manner and to use them only for fulfillment of the committed obligations to „Virginia Records” or the companies of the group and only in compliance with the requirements of GDPR.

Recipients of the data may be government authorities, to which the data must be disclosed under specific legal obligations.

ENSURING SECURITY OF PERSONAL DATA 

For personal data protection all necessary measures are taken in accordance with the provisions and requirements of the current legislation. The service providers are required to implement the necessary measures for protection and data security. Depending on the actuality, implementation expenses and the nature of the data, which must be protected, technical and organizational measures are undertaken to prevent the risks such as destruction, loss, change, unauthorized disclosure or access to personal data.

CONTRACTORS RESPONSIBILITIES

Every contractor is responsible for the accuracy, completeness and actuality of the data, which he/she discloses. In case the contractor discloses data of other individuals to „Virginia Records” or companies of the group, the contractor is responsible for the collection of these data in accordance with the local legal requirements. The individuals whose data are disclosed must be informed about the content of the present Privacy Policy and their consent must be taken.

RIGHTS OF THE PERSONAL DATA SUBJECT

1. At any time during the storage or processing of his/her personal data, each data subject shall have the following rights:

(1) Right of access. The contractor shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed. This includes the right of access to personal data, the right to receive a free copy of the data (except in cases of excessive and repeated inquiries), unless otherwise provided in the applicable personal data protection rules, and the right of the counterparty to be granted a description of the main features related to the processing of his/her personal data, including:

(i) the purposes of the processing;

(ii) the categories of personal data concerned;

(iii) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations;

(iv) the period for which it is envisaged the personal data to be stored, or, if not possible, the criteria used to determine that period;

(v) the existence of the right to request from the controller rectification or deletion of personal data as well as the right to object or to request restriction of processing of personal data;

(vi) the right to lodge a complaint with a supervisory authority;

(vii) where the personal data are not collected from the contractor, any available information as to their source;

(viii) the existence, the mechanism and importance of automated decision-making solutions, including the preparation of personal profiles (profiling).

Where personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards relating to the transfer.

(2) Right to rectification. The contractor shall have the right to rectify without undue delay any inaccurate, incomplete or outdated personal data concerning him or her.

(3) Right to deletion (“right to be forgotten”). The contractor shall have the right to obtain from the controller the deletion of personal data concerning him or her without undue delay where one of the following grounds applies:

(i) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

(ii) contractor objects to the processing;

(iii) the personal data have been unlawfully processed; or

(iv) the personal data of the contractor have to be deleted in compliance with a legal obligation under the European Union or Member State law or other country;

2. „Virginia Records” or a company of the group may refuse to delete the contractor’s personal data if processing is necessary:

(i) for exercising the right of freedom of expression and information;

(ii) for compliance with a legal obligation which requires processing under the European Union or Member State law or other country law or for the performance of a task in public interest;

(iii) for reasons of public interest in the area of public health, for the purposes of scientific or historical research or for statistical purposes; or

(iv) for establishment, exercise or defence of legal claims.

(4) Right to restriction of processing. The contractor shall have the right to obtain from „Virginia Records” or companies of the group restriction of processing where one of the following applies:

(i) the accuracy of the personal data provided by him or her and processed by us is contested by the contractor (for a period enabling the controller to verify the accuracy of the personal data);

(ii) the processing is unlawful and the contractor opposes the deletion of the personal data and requests the restriction of their use instead;

(iii) the controller no longer needs the personal data for the purposes of the processing, but they are required by the contractor for the establishment, exercise or defence of legal claims;

(iv) the contractor has objected to processing and pending the verification whether the legitimate grounds of the controller override those of the data subject.

Where processing of personal data of the contractor has been restricted by the controller, the data subject shall be informed in advance, and before the restriction of processing is lifted.

(5) Right to data portability. This right includes the following options:

(i) the contractor shall have the right to receive the personal data in a structured, commonly used and machine-readable format and the right to transmit those data to another controller, or

(ii) the contractor shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.

(6) Right to object. According to Art. 77 of the General Data Protection Regulation, each contractor has the right to object regarding the processing of his personal data by „Virginia Records” LTD and the companies in the group to the Bulgarian Commission for Personal Data Protection at following address – Sofia, Postal code 1592, 2 „Prof. Tsvetan Lazarov ” Str., (www.cpdp.bg) or by the court.

In the event that a contractor wishes to object the processing of personal data through „Virginia Records” LTD, it may do so at the specified contact details of „Virginia Records” LTD or directly to the Data Protection Officer.

OBTAINING INFORMATION ABOUT THE PERSONAL DATA AVAILABLE AND PROCESSED 

At the request of a contractor, the collector is required to answer what information is stored for that person and how it is processed.

You can request the following information:

• contact details of the organization that processes or on behalf of which the data is processed;
• contact details of the Data Protection Officer;
• the purposes of the processing;
• the legal basis for the processing;
• the relevant categories of personal data being processed;
• the recipients or categories of recipients to whom they are or will be disclosed;
• recipients in third countries or international organizations, if there is transfer of personal data, and guarantees that their data security will be at least at EU level;
• if the processing is based on the legitimate interests of „Virginia Records” LTD or companies of the group, or a third party, information about those interests;
• the estimated period for which the personal data will be stored;
• details of the rights of the contractor to request rectification or deletion of personal data or restrict their processing, as well as to object to such processing;
• information about the right of the contractor to withdraw its consent at any time;
• details of his/her right to object to a supervisory authority;
• information on whether the submission of personal data is a mandatory or contractual requirement, as well as whether the contractor is obliged to provide the personal data, and the possible consequences of the inability to provide such data;
• the source from which the personal data were collected in cases where they were not directly collected by the contractor.
• all details and information about the availability of automated decision making, such as profiling and any meaningful information about the relevant logic of these operations, as well as the significance and expected consequences of this processing.
• Access to personal data that has been processed.

It is necessary to complete a request for access or to request the specified contact information of „Virginia Records” LTD or the Data Protection Officer.

In order to verify the identity of the applicant, it is necessary to provide information – three names, address, telephone number, email, info from personal ID documents, etc.

Consent:

With its consent with the present Privacy Policy, the contractor authorizes „Virginia Records” LTD and the Group companies to process its personal data for the specified purposes.

Basic terms regarding personal data

Importance of basic terms related to the processing of personal data under the General Data Protection Regulation:

– „General data protection regulation” means REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC;

– “personal data” means any information relating to an identified or identifiable natural person (that person is defined as a “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

– „processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

– „controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data;

– „Personal Data Collector” means the related entities, under the meaning of the Commercial Law, namely„Virginia Records” LTD, „Music Mall” LTD, „Virginia Publishing” LTD, „Animato Music” LTD, „Animato Music Publishing” LTD and „Virginia Real Estate” LTD (Companies).

Contact details for „Virginia Records“ LTD:

Location: Republic of Bulgaria; address: 9 „Pop Bogomil” Str., Sofia