TERMS AND CONDITIONS FOR PERSONAL DATA PROTECTION AND PROCESSING 

OF

„VIRGINIA RECORDS” LTD AND AFFILIATED COMPANIES: „MUSIC MALL” LTD, „VIRGINIA PUBLISHING“ LTD, „ANIMATO MUSIC“ LTD, „ANIMATO MUSIC PUBLISHING“ LTD AND „VIRGINIA REAL ESTATE“ LTD,

Hereinafter all referred to as companies of „Virginia Records“ group/administrator

TYPES OF PERSONAL DATA COLLECTED AND PROCESSED 

Depending on the type of contractors of the companies of „Virginia Records” Group – if they are authors, performers, clients, customers, suppliers, business partners and etc., and how they interact with the Group – in person, via internet, telephone and other communication devices, different types of personal data are processed, as follows:

• When the contractors sign authors, producers, performers, management, license or other type of contract/declaration in the copyright and related rights area,
• When they buy or use products and services;
• When they provide goods and services;
• When they participate in events, organized by „Virginia Records”;
• When they interact with the „Virginia Records” group in other ways.

2. The types of data, available for collection from the information, provided by the contractors, are the following:

For the sake of security, data via electronic devices or surveillance system can be recorded when visiting the office of „Virginia Records”.

In certain cases for the contractors, communicating via computer systems a record is created, which includes for example Internet Protocol (IP) address, used for connecting the computer in Internet, log-in, email, password, information for the contractor’s computer and for the methods of connecting, such as the type of the browser and the version of the operational system; data, full time (including the date and time), as well as any phone number used for connection with the operators; in case of paying with bank card – the necessary information for the card for making the transaction.

USE OF PERSONAL DATA

It is possible to use personal data for different reasons and for different purposes permitted by law.

The collected personal data will be used only for the following purposes:

In case of denial of disclosing the minimum data, we will not be able to provide entire services or part of them. It is possible that we will not be able to answer eventual claims and orders.

USE OF PERSONAL DATA FOR MARKETING PURPOSES

It is possible that the companies from „Virginia Records” group will send to their contractors promotional messages for their products, services, events and promotions.

Such promotional messages can be send via courier, email, phone, mail, social media.

When this is required by the legislation, the contractors’ consent will be requested in advance with the possibility for its withdraw at any time.

LEGAL GROUNDS FOR USE/PROCESSING OF PERSONAL DATA

There are various grounds for processing of personal data, such as:

• Contractor’s consent.
• The necessity of creating contract relation with the contractor or for the purpose of fulfillment of our obligations under signed contract;
• The necessity of fulfillment of legislative obligations and for establishment of rights when initiating legal proceedings or defending legal claims;
• The necessity to follow legal interests of the „Virginia Records” group, including:
• Providing protection of networks and information;
• Administration and conducting of the usual activity in the scope of „Virginia Records” LTD and the companies of the „Virginia Records” group;
• Prevention or investigation of supposed or actual violations of the legislation, breaches of contracts with performers, authors, clients or other politics of „Virginia Records” LTD or the companies of „Virginia Records” group.
• The necessity to fulfill the requirements of the contractors;
• The necessity to protect life important interests of certain individual/individuals;
• Keeps and increases the number of its loyal contractors;
• Development and optimizing the realization of its own goods and services;
• Keeping of reports and statistics of our activity and preparing analyses with regard to our activity;
• Every other legislative ground, permitted by Bulgarian law.

PERSONAL DATA PROTECTION

For ensuring adequate protection of the company’s data and the data of the companies of the group and the data of its clients data all necessary organizational and technical measures under the Data Protection Law are implied.

„Virginia Records” has established divisions and responsible persons for prevention of abuses and security breaches, and has appointed Personal data officer, for the purpose of conducting the processes, ensuring personal data security.

For the purpose of maximum security in processing, transfer and records of personal data, additional mechanisms are used for protection such as pseudonymisation and etc.

PERIOD FOR WHICH THE PERSONAL DATA ARE STORED

The personal data are stored for period, necessary for fulfilling the purposes, for which they are collected, including the period of the signed contracts and the rights granted for use. In certain cases under the law, longer storage period could be required or permitted. The used criteria for  setting the storage periods include:

• For what period of time the personal data is necessary for the relevant services and activities;
• Do we have legislative, contract and other similar obligation to keep the data as a legislative requirement, orders from government authorities for keeping of data, connected with investigation, or data, which have to be stored for the purposes of court disputes.
• The use of the personal data for the purposes, connected with the contract relation, in general must be terminated after the termination of the contract, but they are erased after:

• 6 (six) years since the termination of the contract or until the final settlement of every financial obligations and expiration of legal based obligations for data protection;
• Obligations under the Bulgarian Accountancy Act for storage and processing of accountant;
• The prescription periods set in the Bulgarian Law of Obligations and Contracts for claims, obligations for providing information to the court, competent government authorities and other grounds, stipulated in the legislation.

The personal data will not be erased or rendered anonymous if they are necessary for pending court proceedings, administrative proceedings or proceedings before the Administrator.

The personal data could be rendered anonymous. This is alternative of the erase of the data. When rendered anonymous, all personal recognizable elements, allowing the identification of the person, are deleted irreversibly. For the anonymous data there is no legal requirement for erase, because they are not personal data anymore.

DISCLOSING PERSONAL DATA TO COUNTRY OUTSIDE THE EU OR TO INTERNATIONAL ORGANIZATION

The personal data, processed by the „Virginia Records” group are not subject to third person deals for benefits acquisition. The data can be disclosed to service subcontractors, which have signed a contract with a company from „Virginia Records” group, such as:

– Information-technological service providers: with regard to some of the processes of processing the data, such as their storage and security, „Virginia Records” LTD uses third persons services, processing the data, which use data in accordance with the instructions and under the supervision of „Virginia Records” LTD. These third persons are established in the EU.

– Legal services providers – „Virginia Records” LTD uses third persons services – legal services providers in case of disputes with deliveries and etc. The legal services providers process the data, which they use in accordance with the instructions and under the control of „Virginia Records” LTD. These third persons are established in the EU.

– Accounting and audit service providers – „Virginia Records” LTD and the companies of the group use third persons services – accountants and auditors in accounting the deliveries, invoicing, declaring and etc. The accounting and audit service providers process the data, which they use in accordance with the instructions and under the control of „Virginia Records” LTD. These third persons are established in the EU.

– The companies of „Virginia Records” LTD group – „MUSIC MALL” LTD, „VIRGINIA PUBLISHING“ LTD, „ANIMATO MUSIC“ LTD, „ANIMATO MUSIC PUBLISHING“ LTD AND „VIRGINIA REAL ESTATE“ LTD: with regard to the lawful interest to conduct marketing and commercial activity.

– Courier and post services: in case of deliveries, „Virginia Records” LTD and the companies from the group disclose to the courier and post services providers the name, phone and address of the delivery of the courier/post company, which will conduct the delivery, only for the purposes of the delivery and its accounting (without any other personal information).

All third parties which may receive the data, are obliged to keep them in a certain manner and to use them only for fulfillment of the committed obligations to „Virginia Records” and only in compliance with the requirements of GDPR.

The recipients of the data could be government authorities, to which the data must be disclosed under specific legal obligations.

ENSURING PERSONAL DATA SECURITY

For personal data protection all necessary measures are taken in accordance with the provisions and requirements of the current legislation. The service providers are required to implement the necessary measures for protection and data security. Depending on the age, implementation expenses and the nature of the data, which must be protected, technical and organizational measures are undertaken to ensure prevention of risks such as destruction, loss, change, unauthorized disclosure or access to personal data.

CONTRACTORS RESPONSIBILITIES

Every contractor is responsible for the accuracy, completeness and age of the data, which he discloses. In case the contractor discloses data of other individuals to „Virginia Records”, the contractor is responsible for the collection of these data in accordance with the local legislative requirements. The individuals whose data are disclosed have to be informed about the content of the following Terms and Conditions and their consent must be taken.

RIGHTS OF THE PERSONAL DATA SUBJECT

1. At any time during the storage or processing of his personal data, each data subject shall have the following rights:

(1) Right of access. The contractor shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed. This includes the right of access to personal data, the right to receive a free copy of the data (except in cases of excessive and repeated inquiries), unless otherwise provided in the applicable personal data protection rules, and the right of the counterparty to be granted a description of the main features related to the processing of his personal data, including:

(i) the purposes of the processing;

(ii) the categories of personal data concerned;

(iii) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations;

(iv) the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;

(v) the existence of the right to request from the controller rectification or erasure of personal data as well as the right to object or to request restriction of processing of personal data;

(vi) the right to lodge a complaint with a supervisory authority;

(vii) where the personal data are not collected from the contractor, any available information as to their source;

(viii) the existence, mechanism and importance of automated decision-making, including the preparation of personal profiles (profiling).

Where personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards relating to the transfer.

(2) Right to rectification. The contractor shall have the right to rectify without undue delay any inaccurate, incomplete or outdated personal data concerning him or her.

(3) Right to erasure (“right to be forgotten”). The contractor shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay where one of the following grounds applies:

(i) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

(ii) contractor objects to the processing;

(iii) the personal data have been unlawfully processed; or

(iv) the personal data of the contractor have to be erased for compliance with a legal obligation in European Union or Member State law or other country;

2. „Virginia Records” may refuse to erase the contractor personal data if processing is necessary:

(i) for exercising the right of freedom of expression and information;

(ii) for compliance with a legal obligation which requires processing by EuropeanUnion or Member State law or other country law or for the performance of a task carried out in the public interest;

(iii) for reasons of public interest in the area of public health, for the purposes of scientific or historical research or for statistical purposes; or

(iv) for the establishment, exercise or defence of legal claims.

(4) Right to restriction of processing. The contractor shall have the right to obtain from „Virginia Records” restriction of processing where one of the following applies:

(i) the accuracy of the personal data provided by him or her and processed by us is contested by the contractor (for a period enabling the controller to verify the accuracy of the personal data);

(ii) the processing is unlawful and the contractor opposes the erasure of the personal data and requests the restriction of their use instead;

(iii) the controller no longer needs the personal data for the purposes of the processing, but they are required by the contractor for the establishment, exercise or defence of legal claims;

(iv) the contractor has objected to processing and pending the verification whether the legitimate grounds of the controller override those of the data subject.

Where processing of personal data of the contractor has been restricted by the controller, the data subject shall be informed in advance and before the restriction of processing is lifted.

(5) Right to data portability. This right includes the following options:

(i) the contractor shall have the right to receive the personal data in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller, or

(ii) the contractor shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.

(6) Right to object. According to Art. 77 of the General Data Protection Regulation, each contractor has the right to object regarding the processing of his personal data by „Virginia Records” LTD and the companies in the group to the Bulgarian Commission for Personal Data Protection at following address – Sofia, Postal code 1592, 2 „Prof. Tsvetan Lazarov ” Str., (www.cpdp.bg) or by the court.

In the event that a contractor wishes to object regarding the processing of personal data through „Virginia Records” LTD, it may do so at the specified contact details of „Virginia Records” LTD or directly to the Data Protection Officer.

OBTAINING INFORMATION ABOUT THE PERSONAL DATA AVAILABLE AND PROCESSED 

At the request of a contractor, the collector is required to answer what information is stored for that person and how it is processed.

You can request the following information:

• contact details of the organization that processes or on behalf of which the data is processed;
• contact details of the Data Protection Officer;
• the purposes of the processing;
• the legal basis for the processing;
• the relevant categories of personal data being processed;
• the recipients or categories of recipients to whom they are or will be disclosed;
• recipients in third countries or international organizations, if there is a transfer of personal data, and guarantees that their data security will be at least at EU level;
• if the processing is based on the legitimate interests of „Virginia Records” LTD or a third party, information about those interests;
• the estimated period for which the personal data will be stored;
• details of the rights of the contractor to request rectification or erasure of personal data or restrict their processing, as well as to object to such processing;
• information about the right of the contractor to withdraw its consent at any time;
• details of his right to object to a supervisory authority;
• information on whether the submission of personal data is a mandatory or contractual requirement, as well as whether the contractor is obliged to provide the personal data, and the possible consequences of the inability to provide such data;
• the source from which the personal data were collected in cases where they were not directly collected by the data.
• All details and information about the availability of automated decision making, such as profiling and any meaningful information about the relevant logic of these operations, as well as the significance and expected consequences of this processing.
• Access to personal data that has been processed.

It is necessary to complete a request for access or to request the specified contact information of „Virginia Records” LTD or the Data Protection Officer.

In order to verify the identity of the applicant, it is necessary to provide information – three names, address, telephone number, email, personal documents, etc.

Consent:

With its consent with the Privacy Policy, the contractor authorizes „Virginia Records” LTD and the Group companies to process its personal data for the specified purposes.

Basic concepts regarding personal data

Importance of basic concepts related to the processing of personal data under the General Data Protection Regulation:

– „General data protection regulation” means REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC;

– “personal data” means any information relating to an identified or identifiable natural person (that person is defined as a “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

– „processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

– „controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data;

– „Personal Data Collector” means the persons related to the terms of the Commercial Law, „Virginia Records” LTD, Sofia, „Music Mall” LTD, „Virginia Publishing” LTD, „Animato Music” LTD, „Animato Music Publishing” LTD and „Virginia Real Estate” LTD (Companies).

Contact details for „Virginia Records“ LTD:

Location: Republic of Bulgaria; address: 9 „Pop Bogomil” Str., Sofia

Personal Data Protection Officer:

Marko Anastasov, Email marko.anastasov@virginiarecords.com, Phone number 0886 634 136