Privacy Policy

October 2022

We (meaning the specific company identified on this page as the operator of this website) believe that protecting the security and privacy of your personal data is important. This Privacy Policy explains how we collect, store, use, disclose and transfer (hereinafter referred to as “processing”) your personal data. The personal data we collect about you depends on the context of your interaction with us, the products. the services and features you use, your location and applicable law.

1. Processing of personal data related to the use of our websites, applications and online services

Categories of processed personal data and purpose of processing

When you visit our websites or use our applications or online services (all from the category “Papapostolou Online Offering”), we process information that you have actively and voluntarily provided about yourself or that is generated by us in connection with the use of online offers, and includes the following categories of personal data:

• Your contact information, including name, email address, telephone number;
• additional personal data you provide by completing forms in our online offerings;
• Information submitted as part of a support request, survey, comment or forum post; and
• Information about your interaction with the Online Offering, including your device and user ID, information about your operating system, sites and services accessed during the visit, date and time of each visitor request.

We process your personal data for the following purposes:

• Providing the services and features of the Online Offering, which includes creating and administering your online account, updating, troubleshooting, providing support, and improving and developing our online offerings;
• to account for the use of the Online Offering;
• to verify your identity;
• to respond to and fulfill your requests or instructions;
• to process your order or provide you with access to specific information or offers;
• to contact you with information and offers about our products and services, to send you additional marketing information or to contact you as part of customer satisfaction surveys, as explained in section 3; and
• to the extent reasonable and necessary to fulfill the terms of the Online Offering, to establish or maintain a legal claim or defense, to prevent fraud or other illegal activities, including attacks on our information technology systems.

Online offerings provided by your organization

Our Online Offerings may be made available to you for use by the organization to which you belong as our business customers. If your organization provides you with access to the Online Offering, our processing of personal data provided by or collected by you or your organization in connection with the content of the Online Offering is carried out under the direction of your organization and is subject to a data processing agreement between your organization and us. In that case, your organization is responsible for any personal data contained in that content, and you should direct any questions about how the personal data contained in that content is used to your organization.

Links to other websites

This Privacy Policy applies only to the Online Offerings that link to it, and not to other websites or applications of our independent companies that have their own Privacy Policy or that are operated by third parties. This Privacy Policy also does not apply in situations where we only process information on behalf of our business partners, for example when we act as a web hosting or cloud provider. We may provide links to other websites and applications that we think may be of interest to you. We are not responsible for the privacy practices of such other websites or applications.

2. Processing of personal data related to your business relationship with Papapostolou

Categories of processed personal data and purpose of processing

In the context of the business relationship with us, we may process the following categories of personal data of users and contact persons of (prospective) customers, suppliers and partners (each a “business partner”):

• contact information, such as full name, job title, business address, business phone number, business cell phone number, fax number, and work email address;
• payment data, such as data needed to process payments and prevent fraud, including credit/debit card numbers, security code numbers and other related payment information;
• additional information that is necessarily processed within the framework of a project or contractual relationship with us or voluntarily provided by the business partner, such as personal data related to orders placed, payments, requests and project milestones;
• Personal data collected from publicly available resources, databases and credit agencies; and
• If legally required for business partner compliance checks: date of birth, social security numbers, identity cards and information about relevant and significant litigation or other legal proceedings against business partners.

We may process personal data for the following purposes:

• Communication with business partners about our products, services and projects, e.g. by responding to inquiries or requests, or providing you with information about purchased products;
• Planning, implementation and management of (contractual) relations with business partners; for example, by carrying out transactions and ordering products or services, processing payments, performing accounting, auditing activities, invoicing, arranging shipments and deliveries, performing repairs and providing support services;
• Administering and performing market analysis, sweepstakes, contests or other customer activities or events;
• Contact you with information and offers about our products and services, send you additional marketing communications and conduct customer satisfaction surveys as explained in Section 3;
• Maintaining and protecting the security of our products, services and websites, preventing and detecting security threats, fraud or other criminal or malicious activity;
• Ensuring compliance with legal obligations (such as record-keeping obligations), export and customs controls, business partner compliance obligations (to prevent money laundering) and our policies or industry standards; and
• Resolve disputes, enforce our contractual agreements, and establish, exercise or defend legal claims.

3. Processing of personal data for customer satisfaction surveys and for direct marketing

Where and as permitted under applicable law, we may process your contact information for direct marketing purposes (eg invitations to trade shows, newsletters with additional information and offers about our products and services) and to conduct customer satisfaction surveys , also from e-mail. You can object to the processing of your contact data for these purposes at any time by writing to info@papapostolou.bg or by using the opt-out mechanism provided in the relevant communication you received.

4. Transfer and Disclosure of Personal Data

We may transfer your personal data to:

• other related companies or third parties – e.g. trading partners or suppliers – in connection with the use of the online offers or with our business relationship with you;
• third parties who provide IT services to us and process such data only for the purposes of such services (for example, hosting or IT support); and
• third parties in connection with compliance with legal obligations or the establishment, exercise or defense of rights or claims (for example, for legal and arbitration proceedings, before law enforcement authorities and regulators, lawyers and consultants).

Personal data posted by you in Online Offerings (such as chat rooms or forums) may be available on a global scale to other registered users of the relevant Online Offerings.

5. Retention Periods

Unless otherwise stated at the time of collection of your personal data (e.g. in a form completed by you), we delete your personal data if the retention of that personal data is no longer necessary (i) for the purposes for which it was were collected or otherwise processed, or (ii) to comply with legal obligations (such as retention obligations under tax or commercial law).

6. Your Rights

The data protection laws of the jurisdiction in which you reside may give you specific rights in relation to your personal data. In particular, and subject to legal requirements, you may be entitled to

• Receive confirmation from us as to whether or not personal data concerning you is being processed and, where so, access to the personal data;
• Obtain from us the correction of inaccurate personal data concerning you;
• Obtain from us the deletion of your personal data;
• Receive from us a restriction on the processing of your personal data;
• Portability of personal data that you have actively provided; and;
• You object, for reasons related to your specific situation, to further processing of personal data relating to you.

7. Security

To protect your personal data against accidental or unlawful destruction, loss, use or alteration and against unauthorized disclosure or access, we use appropriate physical, technical and organizational security measures.

8. Processing under the EU General Data Protection Regulation: controller, legal basis for processing and international transfers.

This section applies and provides you with additional information if your personal data is processed by one of our companies located in the European Economic Area.

Data controller

The specific company identified on this page as the operator of this website is the data controller within the meaning of the General Data Protection Regulation for the processing activities described in this Privacy Policy.

In the course of our business relationship with you, we may share business partner contact information with Papapostolou affiliates. We and these Papapostolou companies are jointly responsible for the proper protection of your personal data (Article 26 of the General Data Protection Regulation). In order to enable you to effectively exercise your data subject rights in the context of this joint control, we have entered into an agreement with these Papapostolou companies which gives you the right to centrally exercise your data subject rights under section 6 of this Privacy Policy v. Papapostolou EOOD.

To exercise your rights, you can contact:  info@papapostolou.bg

Legal basis of processing

The General Data Protection Regulation (GDPR) requires us to provide you with information about the legal basis for processing your personal data.

The legal basis for processing our data about you is that such processing is necessary for the purposes of

• exercising our rights and fulfilling our obligations under any contract we enter into with you (Article 6, paragraph 1, letter b). General Data Protection Regulation) (“Performance of the Contract”);
• compliance with our legal obligations (Article 6(1)(c) General Data Protection Regulation) (“Compliance with Legal Obligations”); and/or
• legitimate interests pursued by us (Article 6(1)(f) General Data Protection Regulation) (“Legitimate Interest”). In general, the legitimate interest pursued by us in connection with the use of your personal data is the effective performance or management of (i) the use of the online offers and/or (ii) our business relationship with you. Where the table below indicates that we are relying on our legitimate interests for a purpose, we believe that our legitimate interests are not overridden by your interests and rights or freedoms, given (i) regular reviews and related documentation from the processing of activities described herein, (ii) the protection of your personal data by our data privacy processes, (iii) the transparency we provide about the processing activity, and (iv) the rights you have in relation to the processing activity. If you would like to receive further information about this balancing testing approach, please contact us: info@papapostolou.bg

In some cases, we may ask you if you agree to the use of your personal data. In such cases, the legal basis for processing this data about you may (in addition or instead) be that you have given consent (Article 6(1)(a) GDPR) (“Consent”).

Processing of personal data in the context of Online Offerings – purpose and legal basis

To provide the services and functions of the online offering, which includes creating and administering your online account, updating, securing and troubleshooting, providing support, and improving and developing our online offerings

Contract performance (Article 6(1)(b) GDPR)

Legitimate interest (Article 6(1)(f) GDPR)

To invoice use of Online Offerings

Contract performance (Article 6(1)(b) GDPR)

Legitimate interest (Article 6(1)(f) GDPR).

To verify your identity

Contract performance (Article 6(1)(b) GDPR)

Legitimate interest (Article 6(1)(f) GDPR)

To respond to and fulfill your requests or instructions

Contract performance (Article 6(1)(b) GDPR)

Legitimate interest (Article 6(1)(f) GDPR)

To process your order or provide you with access to specific information or offers

Contract performance (Article 6(1)(b) GDPR)

Legitimate interest (Article 6(1)(f) GDPR)

To send you marketing information or to contact you in the context of customer satisfaction surveys, as explained in more detail in section 3

Consent if voluntarily given (Article 6(1)(b) GDPR)

Legitimate interest (Article 6(1)(f) GDPR)

As reasonably necessary to enforce the terms of the Online Offering, to establish or maintain a legal claim or defense, to prevent fraud or other illegal activities, including attacks on our information technology systems

Compliance with legal obligations (Article 6(1)(c) GDPR).

Legitimate interest (Article 6(1)(f) GDPR)

Processing of personal data related to your business relationship with us – purpose and legal basis

Communication with business partners about our products, services and projects, e.g. by responding to inquiries or requests or providing you with technical information about purchased products

Contract performance (Article 6(1)(b) GDPR)

Legitimate interest (Article 6(1)(f) GDPR)

Planning, execution and management of (contractual) relations with business partners; for example, by carrying out transactions and ordering products or services, processing payments, performing accounting, auditing, invoicing and collection activities, arranging shipments and deliveries, facilitating repairs and providing support services;

Contract performance (Article 6(1)(b) GDPR)

Compliance with legal obligations (Article 6(1)(c) GDPR)

Administer and perform market analysis, sweepstakes, contests or other customer activities or events;

Consent if voluntarily given (Article 6(1)(f) GDPR)

Legitimate interest (Article 6(1)(f) GDPR)

Conduct customer satisfaction surveys and direct marketing activities as explained below in Section 3;

Consent if voluntarily given (Article 6(1)(f) GDPR)

Legitimate interest (Article 6(1)(f) GDPR)

Maintaining and protecting the security of our products, services and websites, preventing and detecting security threats, fraud or other criminal or malicious activity;

Legitimate interest (Article 6(1)(f) GDPR)

Ensuring compliance with legal obligations (such as accounting obligations), export and customs controls, business partner screening obligations (to prevent money laundering or money laundering) and our policies or industry standards; and

Compliance with legal obligations (Article 6(1)(c) GDPR)

Legitimate interest (Article 6(1)(f) GDPR)

Resolve disputes, enforce our contractual agreements and to establish, exercise or defend legal claims.

Compliance with legal obligations (Article 6(1)(c) GDPR)

Legitimate interest (Article 6(1)(f) GDPR)

International data transfers

 In the event that we transfer your personal data outside the European Economic Area, we ensure that your data is protected in a manner that complies with the General Data Protection Regulation (GDPR). 

Your competent data protection authority

 In case of concerns and requests related to data privacy, we recommend that you contact us: info@papapostolou.bg. In addition to contacting us, you always have the right to address your request or complaint to the competent data protection authority.

9. Additional Information for US Residents

If you are a US resident, please note the following:

Do not track

 Our online offerings do not currently recognize or respond to Do Not Track browser signals. For more information about Do Not Track, please visit your browser’s support page.

Use by children

 This online offer is not directed at children under the age of thirteen. We will not knowingly collect personal data from children under the age of thirteen without requiring them to seek prior parental consent if required by applicable law. We will only use or disclose personal data about a child to the extent permitted by law to seek parental consent, comply with local laws and regulations, or to protect a child.