PRIVACY POLICY

What information do we collect about you?

We collect information about you when you book a Green Valleys tour. We also collect information when you provide feedback or use our online chat. Website usage information is collected using cookies. The types of information we collect can be the following; Names of people booking tours or products, payment details, address, email address, phone number and country of residence. In this regard, we are considered therefore to be a ‘data processor’.

Extra information you may wish to provide e.g. Information about your health, if you have a medical condition that may affect your tour such as the provision of wheelchair assistance or oxygen or dietary requirements which is not ’sensitive data’ but may imply or suggest your religion, health or other information.

How will we use the information about you?

The Green Valleys Ltd use your personal data for the following purposes:

To provide you services and enhance your experience with us.
To manage the tour check-in process
To send a confirmation of booking and reminder e-mail or to provide further information.
Confirming your identity when you contact us
To obtain feedback on our product and services
Management Information reporting

How long will we hold your personal data?

Green Valleys Tours will hold your data for a reasonable period to fulfil the requirements of the purposes of processing that data and will regularly review all data held by the company and delete securely as and when required.

Who will access your personal data within Highland Experience?

Some of your personal data will be available to Green Valleys employees.

The type of personal data shared will be relevant to the purpose for which the data is used.

Sharing your personal data with third parties

Third parties are organisations that are not Green Valleys Ltd.

We share your name with third parties such as:

Accommodation Providers and other third party attraction suppliers

When we share your data, we only share the minimum required for the purpose of the data processing. We also ensure that processes are in place so that data is always transferred to third parties securely.

We will share with credit and charge card companies, credit reference agencies and anti-fraud screening service providers to process payments, and (where necessary) to carry out fraud-screening.

We will not share your personal information with any other third party.

How do you protect my data?

Any information sent to Green Valleys is protected using robust industry-standard security methods ensuring data is safeguarded whilst being sent over unprotected communications paths such as the internet. When it reaches us, we store it securely and only provide access to those authorised. Although we safeguard your personal information once received, Green valleys cannot guarantee the safety of any personal information you transmit to us using online methods due the inherently insecure nature of the internet.

Our security measures include:

EV SSL certificate to provide a maximum secure internet connection
Industry standard Next-Gen firewalls
Encryption of data where appropriate
Penetration testing of systems
Internal policies setting out our data security approach
Training for employees on security and privacy

Access to your information and correction

You have the right to request a copy of the information that we hold about you. If you would like a copy of some or all your personal information, please email or write to us at the following address CONTACT US.We want to make sure that your personal information is accurate and up to date. You may ask us to correct or remove information you think is inaccurate.

Cookies

Cookies are text files placed on your computer to collect standard internet log information and visitor behaviour information. This information is used to track visitor use of the website and to compile statistical reports on website activity.

For further information visit www.aboutcookies.org or www.allaboutcookies.org.

You can set your browser not to accept cookies and the above websites tell you how to remove cookies from your browser. However, in a few cases some of our website features may not function as a result.

Other websites

Our website contains links to other websites. This privacy policy only applies to this website so when you link to other websites you should read their own privacy policies.

Changes to our privacy policy

We keep our privacy policy under regular review and we will place any updates on this we b page. This privacy policy was last updated on 23rd January 2020.

How to contact us

Please contact us if you have any questions about our privacy policy or information we hold about you:

Email:  office@greenvalley.online

Tel:   00359 897 227 481

00359898 437 303

In-depth information on personal data protection rights

Information about the company that processes your data:

Website: https://greenvalleys.websitebuilder.bg

Information on the competent supervisory authority for the protection of personal data

Name: Personal Data Protection Commission

Registered office and address:

Mailing address: 1592 Sofia, Prof. Tsvetan Lazarov ”№ 2

Phone: 02 915 3 518

Website: www.cpdp.bg

https://greenvalleys.websitebuilder.bg (Hereinafter referred to as Administrator or Company) carries out its activities in accordance with the Personal Data Protection Act and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data . This information is intended to inform you about all aspects of the processing of your personal data by the Company and the rights you have in connection with such processing.

Grounds for collecting, processing and storing your personal data

Art. 1.The Administrator collects and processes your personal data in connection with the use of the e-shop https://greenvalleys.websitebuilder.bg and the conclusion of contracts with the company on the basis of Art. 6, para. 1, Regulation (EU) 2016/679 (GDPR), and in particular on the following grounds :

Your explicit consent as a client;
Fulfillment of the obligations of the Administrator under a contract with you;
Compliance with a legal obligation that applies to the Administrator;
For the legitimate interests of the Administrator or a third party;

Objectives and principles for the collection, processing and storage of your personal data

Art. 2.(1)We collect and process the personal information you provide to us in connection with the use of the online store and contract with the company, including for the following purposes:

creating an account and providing full functionality when using the online store;
concluding and executing a distance contract;
individualisation of a party to the contract;
accounting purposes;
statistical objectives;
protection of information security;
ensuring the performance of the contract for the provision of the relevant service.
 sending a newsletter if you wish;

(2) We respect the following principles in the processing of your personal information:

lawfulness, good faith and transparency;
limitation of processing purposes;
correlation with the purposes of processing and minimizing the data collected;
data accuracy and timeliness;
limiting storage to achieve goals;
the integrity and confidentiality of the processing and ensuring an adequate level of personal data security.

(3) In the processing and storage of personal data, the Administrator may process and store personal data in order to protect the following legitimate interests:

fulfilling their responsibilities to the National Revenue Agency, the Ministry of the Interior and other state and municipal bodies.

What kinds of personal information is collected, processed and stored by our company

Art. 3. (1) The Company performs the following operations with the personal data you provide for the following purposes:

Register a user in an online store and perform a distance sales contract – The purpose of this operation is to create an account to use the online store to purchase goods and provide contact information for delivery of purchased goods. Registering and creating an account to use the online store is not a necessary step in the provision of the service, and it is accessible to a large extent without creating an account.
Impact assessment conclusion : Based on the impact assessment carried out, the operation “Registration of a user in an online store and execution of a distance sales contract” is eligible and provides sufficient guarantees for the protection of rights and the legitimate interests of the data subjects in accordance with GDPR requirements.
Conclude and execute a trade transaction with a client or partner – the purpose of this operation is to conclude and execute a contract with a commercial partner or client and its administration. Given the limited scope of personal data collected and the fact that some of it is collected from publicly available sources, an impact assessment does not need to be carried out.
Send newsletter (newsletter) -the purpose of this operation is to administer the process of sending newsletters to clients who have stated that they wish to receive. Given the limited scope of personal data collected, an impact assessment does not need to be carried out on the impact of the operation.
Exercising the Right of Refusal or Claim – The purpose of this operation is to administer the process of exercising the right of refusal or claim by the client. Given the limited scope of personal data collected, an impact assessment is not necessary to conduct an impact assessment of the operation.

(2) The administrator processes the following categories of personal data and information for the following purposes and for the following reasons:

Your personally identifiable information (email, name, etc.)
Purpose for which the data is collected: 1) Contact and send information to the user, 2) for the purpose of registering a user in the online store, and 3) to send newsletter.
Reason for processing your personal data – By accepting the general terms and conditions and registering in the online store or placing an order without registration, or at the conclusion of a written contract, a contractual relationship is created between the Administrator and you, on the basis of which we process your personal data – Art. 6, para. 1, b. (b) GDPR. Your data for sending a newsletter are processed by your explicit consent – Art. 6, para. 1, b. (a) GDPR.
Delivery details (names, phone, address, etc.)
Purpose for which the data is collected: Fulfillment of the administrator’s obligations under the contract of sale and delivery of the purchased goods.
Grounds for processing your personal data – By accepting the terms of service and registering in an online store or placing an order without registration, or upon entering into a written contract, a contractual relationship is created between the Administrator and you on which grounds we process your personal data – Art. 6, para. 1, b. (b) GDPR.
Additional information provided by you – If you would like to supplement your account, you can fill in your name, surname, phone number.
Purpose for which data is being collected: Adding user information to their user account.
Grounds for data processing: You have provided express consent to the processing of his personal data for one or more specific purposes – 6, para. 1, b. (a) GDPR at the time of registration in the online store. The provision of this information is not compulsory for online store registration.

(3) The administrator does not collect or process personal information related to the following:

disclose racial or ethnic origin;
reveal political, religious or philosophical beliefs, or membership of trade unions;
Genetic and biometric data, health data, or sexual or sexual orientation data.

(4) The personal data are collected by the Administrator from the data subject.

(5) The company does not make automated data decisions.

Art. 4. (1) The Company performs the following transactions with the personal data provided by you, as legal representatives or proxies of legal persons-trading partners, for the following purposes:

Conclusion and execution of a business transaction: For the conclusion and execution of a trade transaction with a company, we only process the names of the legal representative or the person authorized by the company. Impact assessment conclusion: Given the small volume of individuals whose data is processed and the limited amount of personal data that is collected, conducting an impact assessment is not necessary for this operation.

>

(2) Personal data are collected by the Administrator from persons to whom they also relate to the Commercial Register of the Registry Agency.

(3) The company does not make automated data decisions.

Art. 5. The administrator can use the so-called. Cookies for the purpose of providing the full functionality of the Website, enhancing the user experience, statistical purposes, easy access, etc., which you consent to through the use of our website. You may at any time control and / or delete cookies through the settings of the browser you are using. Cookies are not personally identifiable information and are not used to identify visitors and users of the online store.

& nbsp;

The term of storage of your personal data

Art. 6. (1) The administrator stores your personal data for no longer than the existence of your online store account. After deleting your account, the Administrator takes the necessary care to delete and destroy all your data without undue delay or anonymize it (ie, make it look like it does not reveal your identity).

(2) The administrator processes your personal data that you provided when placing an order without registering in the online store, until the completion of the order, unless you have given your explicit consent when completing the order. processed for the purpose of improving the service,providing recommended content for you, individual terms, promotions, and for statistical purposes.

(3) The Administrator shall store your personal data provided in connection with online orders for a period of 5 years for the purposes of protecting the Administrator’s legal interests in legal or administrative disputes with users of the online store .

(4) The Administrator notifies you in the event that the data retention period is required to be extended for the purpose of fulfilling a regulatory obligation or for the legitimate interests of the Administrator or otherwise.

(5) The Administrator stores the personal data that he / she must keep under applicable law for the appropriate timeframe, which may exceed the duration of your e-commerce account or until the end of your account. order.

Art. 7. The Administrator shall keep the personal data of the legal representatives of his trading partners for the duration of the performance of the contract, for compliance with the legitimate interests and legal obligations of the Administrator, which may exceed the term of the contract.

& nbsp;

Transmission of your personal data for processing

& nbsp;

Art. 8. (1) The administrator mayown discretion to transmit some or all of your personal data to processing data for the fulfillment of processing objectives that you have agreed to, subject to the requirements of Regulation (EU) 2016/679 (GDPR).

(2) The Administrator notifies you in case you intend to share some or all of your personal information with third countries or international organizations.

& nbsp;

Your rights to collect, process and store your personal data

& nbsp;

Withdrawal of consent to process your personal data

& nbsp;

Art. 9. (1) If you do not wish your personal data to be processed for marketing purposes and to receive a newsletter, you may withdraw your consent to the processing at any time by filling out the consent withdrawal form in Annex No. 1, or by requesting in free text, and emailing us.

(2) Once we receive your request, we will send you the email you specified to receive newsletters and advertisements, a letter detailing your verification as the recipient of the newsletters and data subject requesting your withdrawal of consent.

(3) Withdrawal of consent does not affect the lawfulness of the processing of personal data that the Administrator has done so far.

& nbsp;

Right of access

& nbsp;

Art. 10. (1) You have the right to request and receive confirmation from the Administrator whether personal data relating to you is being processed by sending a free text request via email.

(2) You have the right to access data related to you, as well as information related to the collection, processing and storage of your personal data.

(3) Once we receive your request, we will send you an email that you used to register or place an order at the online store, a letter with detailed instructions for verifying you as a data subject. to which access is requested.

(4) After carrying out the verification according to para. 3, The Administrator shall provide you, upon request, with a copy of the personal data processed relating to you, in electronic or other appropriate form.

(5) Providing access to the data is free of charge, but the Administrator reserves the right to impose an administrative fee in case of repetition or excessive requests.

& nbsp;

Right to Correct or Complete

& nbsp;

Art. 11. (1) You may at any time correct or fill in inaccurate or incomplete personal data relating to you through the ‘Edit Profile’ option.

(2) You may correct or fill in inaccurate or incomplete personal data relating to you directly through your website account or by requesting the Email Administrator using the form in Attachment No. 4 or by requesting in free text.

& nbsp;

Right to delete (“to be forgotten”)

Art. 12. (1) You have the right to request from the Administrator the deletion of part or all of your personal data, and the Administrator has the obligation to delete them without undue delay when any of the following reasons exist: < / p>

Personal data are no longer needed for purposes for which they were otherwise collected or processed;
You withdraw your consent on which the processing of the data is based and there is no other legal basis for the processing;
You object to the processing of personal data relating to you, including for direct marketing purposes, and there are no legitimate grounds for processing to take precedence;
personal data were processed illegally;
personal data must be deleted in order to comply with a legal obligation under EU or Member State law that applies to the Administrator;
Personal information has been collected in connection with the provision of information society services.

(2) The administrator is not required to delete personal data if it stores and processes them:

to exercise the right to freedom of expression and the right to information;
to comply with a legal obligation requiring processing as provided for in EU or Member State law that applies to the Administrator or for the performance of a public interest task or in the exercise of official powers conferred on it; < / li>
for reasons of public interest in the field of public health;
for purposes of archiving in the public interest, for scientific or historical research or for statistical purposes;
To establish, pursue, or defend legal claims.

(3) To exercise your right to be forgotten, you must submit by email requesting to delete your personal data that the Administrator processes by filling in the form in Appendix 2 or by requesting in free text, after which the Administrator will send to the email you used to register or place orders in the online store, a letter with detailed instructions for verifying you as a store user and data subject who has been requested to be deleted.

(4) After verifying the identity of the requester and the data subject in accordance with your instructions, we will delete all the data we process for you in accordance with para. 3.

(5) If you have an order in progress, the earliest time you can ask to be “forgotten” is when the order is successfully completed.

& nbsp;

Right of Restriction

& nbsp;

Art. 13. You have the right to request that the Administrator restrict the processing of your data by sending us a free text request when:

dispute the accuracy of personal data for a period allowing the Administrator to verify the accuracy of personal data;
the processing is improper, but you do not want the personal data to be deleted and only their use restricted;
The controller no longer needs personal data for processing purposes, but you require it to establish, exercise or defend your legal claims;
You objected to the pending review of whether the Administrator’s legitimate grounds outweighed your interests.

(2) Once we receive your request, we will send you an email with the email you used to sign up for or place orders at the online store detailed instructions for verifying you as a store user and data subject requesting a restriction on processing.

(3) After completing the verification under par. 2, the Company will cease processing your data, but will not remove any postings you made on the online store, if any.

Right to portability

Art. 14. (1) If you have consented to the processing of your personal data or the processing is necessary to perform the contract with the Administrator, or if your data is processed in an automated manner, you may:

request the Administrator to provide you with your personal data in a readable format and transfer it to another Administrator;
Request the Administrator to directly transfer your personal data to the Administrator you have specified when technically feasible.

(2) You may exercise the right of portability by emailing us with a completed form under Annex No. 3 or a free text request, after which the Administrator will send to the email you used to register or place orders in the online store, a letter with detailed instructions for your verification as a store user and data subject for portability.

(3) After carrying out the verification in accordance with para. 2, the Company sent the XML data it processes for you in XML format.

& nbsp;

Right to Receive Information

& nbsp;

Art. 15. You may ask the Administrator to inform you of any recipients to whom the personal data for which rectification, erasure or restriction has been requested processing, have been disclosed. The administrator may refuse to provide this information if this would be impossible or would require a disproportionate effort.

& nbsp;

Right to Objection

& nbsp;

Art. 16. You may object at any time to the processing of personal data by the Administrator relating to it, including if it is processed for profiling or direct marketing purposes.

Your rights in breach of your privacy

& nbsp;

Art. 17. (1) If the Administrator identifies a breach of the security of your personal data which may pose a high risk to your rights and freedoms, he shall notify you without undue delay of the breach, as well as of the measures taken or to be undertaken.

(2) The administrator is not required to notify you if:

has taken appropriate technical and organizational safeguards with respect to data affected by a security breach;
subsequently took measures to ensure that the breach would not pose a high risk to your rights;
notification would require a disproportionate effort.

& nbsp;

Persons to whom your personal information is provided

& nbsp;

Art. 18. (1) For the purposes of processing your personal data and providing the service with its full functionality and for your interests, the Administrator may provide the data to the following data processing personalities:

& nbsp;

Personal Data Processor Purpose of processing personal data

………………………………………..         ……………………………………………………………

………………………………………..         ……………………………………………………………

………………………………………..         ……………………………………………………………

(2) Personal data processing complies with all legal and security requirements when processing and storing your personal data.

Art. 19. The administrator does not transfer your data to third countries.

Art. 20. In the event of a violation of your rights under the aforementioned or applicable personal data protection legislation, you have the right to file a complaint with the Personal Data Protection Commission as follows:

& nbsp;

Name: Data Protection Commission.

Registered office and registered office: 1592 Sofia, Prof. Tsvetan Lazarov ”No. 2

Correspondence Address: Sofia 1592, Prof. Tsvetan Lazarov ”No. 2

Phone: 02 915 3 518

Website: www.cpdp.bg

& nbsp;

Art. 21. You can exercise all your rights regarding the protection of your personal data through the forms attached to this information. Of course, these forms are optional and you can submit your requests in any form that contains a statement to that effect and identifies you as the data owner.

Art. 22. If the consent concerns a transfer, the Administrator shall describe the potential risks of transferring the data to third countries in the absence of adequate protection and adequate remedies.

& nbsp;

App # 1

& nbsp;

Consent Withdrawal Form

Your name * : …………………….

Your email that you used in the online store * : …………………….

Contact Details (e-mail) * : …………………….

& nbsp;

Until

Name: …………………….

UIC / BULSTAT: …………………….

Headquarters and management address: …………………….

Correspondence address: …………………….

Phone: …………………….

Email: …………………….

Website: …………………….

& nbsp;

I hereby withdraw my consent to the processing of personal data I provide for the purposes of receiving newsletter, advertisements or other marketing material, and I am aware of the conditions for withdrawal of consent in accordance with the Mandatory Information on the Rights of the e-commerce privacy protectors.

In case of violation of your rights under the aforementioned or applicable personal data protection law, you may file a complaint with the Data Protection Commission as follows:

& nbsp;

Name: Data Protection Commission.

Registered office and registered office: 1592 Sofia, Prof. Tsvetan Lazarov ”No. 2

Correspondence address: 1592 Sofia, Prof. Tsvetan Lazarov ”No. 2

Phone: 02 915 3 518

Website: www.cpdp.bg

& nbsp;

App # 2

& nbsp;

Request to be forgotten – to delete personal information related to me

& nbsp;

Your Name * : …………………….

Your email with which you have registered or used to place orders in the online store * : …………………. …

Contact Details (e-mail) * : …………………….

& nbsp;

Until

Name: …………………….

UIC / BULSTAT: …………………….

Headquarters and management address: …………………….

Mailing Address: …………………….

Phone: …………………….

Email: …………………….

Website: …………………….

I ask that all personal data you collect, process and store, provided by me or by third parties associated with me, according to the identified identification, be deleted from your databases.

I declare that I am aware that some or all of my personal data may continue to be processed and stored by the controller for the purposes of fulfilling his legal obligations.

In the event of a violation of your rights under the aforementioned or applicable data protection legislation, you have the right to file a complaint with the Data Protection Commission as follows:

& nbsp;

Name: Data Protection Commission.

Headquarters and management address: 1592 Sofia, Prof. Tsvetan Lazarov ”No. 2

Correspondence Address: Sofia 1592, Prof. Tsvetan Lazarov ”No. 2

Phone: 02 915 3 518

Website: www.cpdp.bg

& nbsp;

App # 3

& nbsp;

Request for portability of personal data

& nbsp;

Your Name * : …………………….

Your email with which you have registered or used to place orders in the online store * : …………………. …

Feedback (e-mail) * :…………………….

Until

Name: …………………….

UIC / BULSTAT: …………………….

Headquarters and management address: …………………….

Mailing Address: …………………….

Phone: …………………….

Email: …………………….

Website: …………………….

& nbsp;

I ask that all personal data that is collected, processed and stored in your databases be sent in XML format:

e-mail: …………………….

Data Admin Administrator: …………………….

& nbsp;

Name : …………………….

Identification number (UIC, BULSTAT, CPDP Reg.) : ……………………. < / p>

Email : …………………….

& nbsp;

In the event of a violation of your rights under the aforementioned or applicable personal data protection legislation, you have the right to file a complaint with the Data Protection Commission as follows:

& nbsp;

Name: Personal Data Protection Commission.

Registered office and address: 1592 Sofia, Prof. Tsvetan Lazarov ”No. 2

Correspondence Address: Sofia 1592, Prof. Tsvetan Lazarov ”No. 2

Phone: 02 915 3 518

Website: www.cpdp.bg

& nbsp;

App # 4

& nbsp;

Data Correction Request

& nbsp;

Your Name * : …………………….

Your email with which you have registered or used to place orders in the online store * : …………………. …

Contact Details (e-mail) * : …………………….

До

Name: …………………….

UIC / BULSTAT: …………………….

Headquarters and management address: …………………….

Mailing Address: …………………….

Phone: …………………….

Email: …………………….

Website: …………………….

& nbsp;

Please collect the following personal data that you collect, process and store, provided by me or by third parties who are affiliated with me, as follows:

Data to be corrected:

……………………………………….. …

Please correct as follows:

……………………………………….. …

In case of violation of your rights under the aforementioned or applicable personal data protection law, you may file a complaint with the Data Protection Commission as follows:

& nbsp;

Name: Data Protection Commission.

Registered office and registered office: 1592 Sofia, Prof. Tsvetan Lazarov ”No. 2

Correspondence Address: Sofia 1592, Prof. Tsvetan Lazarov ”No. 2

Phone: 02 915 3 518

Website: www.cpdp.bg