Personal Data Protection Policy

​

1. INTRODUCTION

This Privacy Policy ("Policy") sets out the rules regarding the protection of personal data of individuals using the Website (the "Platform") owned by Tensui Talents
The website is fully compliant with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC ("the Regulation"), which entered into force on 25.05.2018, and the Personal Data Protection Act ("PDPA").
By using the Platform, you accept and undertake to comply with this Personal Data Protection Policy, the Cookies Policy and the General Terms and Conditions of the Website.

1. DEFINITIONS

   1. "Personal Data" is any information relating to a natural person (Data Subject) who is identified or can be identified directly or indirectly by an identifier such as: name, personal identification number, location information, gender, address, telephone number, online identifier or by one or more characteristics specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. 

   2. "Processing of personal data" means any action or set of actions performed with personal data by automated or other means such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or other means by which the data becomes accessible, arrangement or combination, restriction, deletion or destruction.

   3. "Personal Data Subject" is any natural person who is a User of 

   4. "Website/Site" means the content of the www.tensuitalents.com domain  and its subdomains;

1. PRINCIPLES OF PERSONAL DATA PROTECTION

   1. Legality, good faith, transparency

Personal data must be processed lawfully, fairly and in a transparent manner in relation to the data subject. In view of this, Tensui Talents collect and process your personal data only for the following purposes:

1. management of your request and concluded contract

   1.  On the basis of the contract concluded between us and you, we process information about the type and content of the contractual relationship:

      1. Personal contact details – full name, contact address, email, phone number;

      2. identification data - three names, a single civil number or a personal number of a foreigner, permanent address;

      3. e-mail, letters, information about your requests for troubleshooting, complaints, requests, complaints;

2. Saving correspondence in connection with already placed orders, processing requests, reporting problems, etc.

3. contacting the User and sending information to him.

4. For the fulfillment of regulatory obligations.

1. Collection Limitation

Personal data must be collected for specific, explicit and lawful purposes and not processed in a way that is incompatible with these purposes. Tensui Talents collects and processes your personal data for the following purposes: creating a profile and providing full functionality when using the online store;

1. placing orders and purchasing services;

2. individualization of a party to the contract;

3. accounting purposes;

4. statistical purposes;

5. protection of information security;

1. Data minimization 

Personal data must be adequate, relevant and limited to what is necessary with regard to the purposes for which Tensui Talents in its capacity as Controller applies anonymity or pseudonymisation of personal data, if possible, in order to reduce the risks for the data subjects concerned. 

1. Accuracy

Personal data must be accurate and, where necessary, updated; reasonable steps must be taken to ensure that inaccurate personal data, having regard to the purposes for which they are processed, are erased or corrected in a timely manner. Tensui Talents is not responsible for incorrectly provided data by its Users.

1. Storage limitations

Tensui Talents stores your personal data for a period not longer than the moment of withdrawal of consent to processing. After deletion of your account or successful completion, the Administrator takes the necessary care to delete and destroy all your data without undue delay or to anonymize it (i.e. to bring it into a form that does not reveal your identity).

1. Integrity and confidentiality

Tensui Talents processes your personal data in a way that ensures an appropriate level of security of personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, applying appropriate technical or organizational measures;
 
Where we are required by law, we may provide your personal data to the competent state authority, natural or legal person.
 

1. CONSUMER RIGHTS

Each User of the site enjoys all rights for the protection of personal data in accordance with the Bulgarian legislation and the law of the European Union. 
 

1. Right of access:

The right of access provides each User with the opportunity to receive a copy of their data, but also the right to receive detailed explanations as to whether the relevant data is being processed lawfully. Each Data Subject has the right to understand the following:

1. the purposes for which the personal data provided are used

2. the categories of these data

3. whether the company has shared the data with third parties and, if so, who those parties are

4. all sources from which the company obtained your personal data

5. Retention period of your data

6. other rights you have against the company, including the right to rectify your data, delete your data (in certain circumstances), or restrict or object to the company's use of your data

7. If the Company uses your data in an automated decision-making process (such as decisions made through artificial intelligence or an algorithm), meaningful information about the logic behind that algorithm, and the significance and consequences that the Company foresees for the use of your information in this way

8. if the data is sent outside the European Union and, if so, what safeguards are in place to protect your data.

1. Right to erasure/ “To be forgotten”

The data subject has the right to request from the controller the deletion of the personal data related to him without undue delay, where any of the following grounds is applicable:

1. the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;

2. the data subject withdraws his/her consent on which the data processing is based and there is no other legal basis for the processing;

3. the data subject objects to the processing pursuant to Article 21(1) (GDPR) and there are no legitimate grounds for the processing to prevail, or the data subject objects to the processing pursuant to Article 21(2) (GDPR);

4. personal data has been processed unlawfully

5. the personal data must be erased in order to comply with a legal obligation under Union or Member State law that applies to the controller;

6. the personal data was collected in connection with the provision of information society services under Article 8(1) (GDPR).

1. Right to portability.

The data subject has the right to receive the personal data concerning him or her and which he has provided in a structured, commonly used and machine-readable format and has the right to transfer this data to another controller without hindrance where:

1. the processing is based on consent in accordance with Article 6(1)(a) or Article 9(2)(a) (GDPR) or on a contractual obligation pursuant to Article 6(1)(b) (GDPR); and

2. processing is carried out in an automated way

1. Right to object.

Users have the right to object to the processing of their personal data before the controller and the controller is obliged to terminate this effect, unless it proves that there are compelling legal grounds for it, which take precedence over the interests, rights and freedoms of the data subject, or for the establishment, exercise or defense of legal claims.  for direct marketing purposes, it should be terminated immediately.
 

1. PROCESSING OF ANONYMISED DATA

We process your data for static purposes, this means for analyses in which the results are only aggregated and therefore the data is anonymized. It is impossible to identify a specific person from this information.

1. For the fulfillment of regulatory obligations

There may be a legal obligation for us to process your personal data. In these cases, we are obliged to carry out the processing, such as:

1. Obligations under the Measures Against Money Laundering Act;

2. fulfillment of obligations in relation to distance selling, off-premises sales provided for in the Consumer Protection Act;

3. providing information to the Commission for Consumer Protection or third parties provided for in the Consumer Protection Act;

4. providing information to the Commission for Personal Data Protection in relation to obligations provided for in the legal framework for personal data protection;

5. obligations provided for in the Accountancy Act and the Tax and Social Security Procedure Code and other related normative acts, in connection with the keeping of lawful accounting;

6. provision of information to the court and third parties, within the framework of proceedings before a court, in accordance with the requirements of the normative acts applicable to the proceedings;

7. age verification when shopping online.

1. Processing and storage periods

The data collected under a statutory obligation is deleted after the collection and storage obligation has been fulfilled or has ceased to exist, such as:

1. under the Accountancy Act for storage and processing of accounting data (11 years),

2. obligations to provide information to the court, competent state authorities, etc. grounds provided for in the legislation in force (5 years).

1. DATA SECURITY

In order to maximize security in the processing, transmission and storage of your data, we may use additional protection mechanisms such as encryption, pseudonymization, etc.
Ensuring the security and confidentiality of the personal data entrusted to you is our priority. Therefore, We apply all appropriate technical and organizational measures in accordance with the applicable legal provisions, taking into account the nature of the personal data transmitted by you, as well as the risks associated with their processing, in order to maintain their security and, in particular, to prevent any accidental or unlawful destruction,  any kind of loss, alteration, disclosure, intrusion or unauthorized access to them.   
 

1. LIABILITY OF DATA PROTECTION OFFICERS (DPCS)

The responsible employees of the company assist the Controller or the data processor in all matters related to the protection of personal data. In particular, they must:

1. to inform and give advice to the Controller and/or the Data Processor, as well as to their employees about their obligations under the Data Protection Act;

2. monitor the organisation's compliance with all data protection legislation, including audits, awareness-raising activities, as well as training of staff involved in processing operations;

3. advise when a Data Protection Impact Assessment (DPIA) has been carried out and monitor its implementation;

4. act as a point of contact for requests from individuals regarding the processing of their personal data and the exercise of their rights;

5. cooperate with the Data Protection Authorities (DPAs) and act as a contact point for DPAs in matters related to processing.

1. INCIDENT REPORTING PROCEDURE

Each User has the right to file a complaint against unlawful processing of his/her personal data to the Commission for Personal Data Protection or to the competent court.