Information about data protection

Data controller

• Company Name: АМАРА НЕТ ЗЕРО БЪЛГАРИЯ ЕООД / ЕИК 207399900
• Location: София 1505, район Оборище, Бул. „Ситняково” № 48, Офиси Сердика, етаж 7, офис 705б
• Data Protection Officer: Представител за защита на данните - dpo@amaranzero.com

Objectives of processing personal data for involved individuals 

• Management and control of user relationships on the website
• Sending commercial messages owned by AMARA
• Sending commercial messages from third parties
• Generating profiles with internal information
• Generating profiles created with external information
• Providing Customer Service
• Management and control of stakeholder satisfaction
• Service for compliance with legal obligations
• Management and control of visits to facilities
• Providing advertised job positions
• Providing potential future job positions

Rights of interested parties

We inform you that, where applicable, you have the right to exercise your rights of access, rectification, objection, erasure, portability, and restriction of processing. Similarly, you can withdraw your consent if you have given it for a specific purpose.

These rights can be exercised via email: dpo@amaranzero.com or at the company's address of AMARA.

You can file complaints with the Commission for Personal Data Protection: www.cpdp.bg, the Supervisory Authority for Bulgaria. More information is in the 'Additional Information on Data Protection'.

Additional information on data protection 

You can obtain more information at the address: https://amaranzero.bg.

• Who is responsible for processing your data?

In compliance with the current data protection legislation, with special attention to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals concerning the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as 'GDPR'), the data subject is informed that personal data will be processed as the data controller by 'AMARA NET ZERO BULGARIA' EOOD, EIK 207399900, Sofia 1505, Oborishte district, Blvd. 'Sitnyakovo' № 48, Offices Serdika, floor 7, office 705 b.

For any questions regarding the processing of your personal data, you can contact our Data Protection Officer (DPO) by email at: dpo@amaranzero.com, attaching a copy of your identity document or another document permitted by law that allows us to identify you, with the subject line 'Data Protection'.

• What data is processed, for what purpose, and on what legal basis for legitimization?

The personal data provided by the data subject may be processed by AMARA for one of the following purposes, taking into account the nature of the provided data and the legal basis for legitimization:

Purpose 1 – Management and control of the relationship with web users

• Description of the purpose: To manage the personal data of users who connect with AMARA through the contact form provided to users. Your data will be processed to manage the relationship, respond to inquiries, doubts, or comments that you send us through the channels activated for this purpose on our website. 
• Legal basis: Article 6.1.b) GDPR - Processing necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract.
• Data processed for this purpose: Identification data (name, surname, identity documents, postal and/or email address, phone number, image, voice, etc.), personal characteristic data (marital status, date of birth, nationality, gender, etc.).

Purpose 2 – Sending commercial messages owned by AMARA

• Description of the purpose: Sending commercial messages about products and/or services, similar to those agreed upon by the data subject, to maintain relationships for advertising and promotional purposes related to the products and/or services offered on the market by AMARA, conducted through conventional and/or electronic means (emails, SMS, purchase coupons, etc.).
• Legal basis for processing: Article 6.1.f) GDPR - Processing is necessary for the purposes of the legitimate interests pursued by the data controller. AMARA has conducted a detailed assessment of the priority of the rights and freedoms of the data subjects, performing a thorough assessment of the legitimate interest that exceeds the minimal interference arising from the fundamental right to the protection of personal data of the individuals affected by data processing. For more information, you can consult the Data Protection Officer via the following email address: dpo@amaranzero.com.
• Data processed for this purpose: Identification and contact data (name, surname, identity documents, postal and/or email address, phone number, image, voice, etc.).

Purpose 3 - Sending commercial messages to third parties     

• Description of the purpose: Sending commercial messages for products and/or services, different from those agreed upon by the data subject, to maintain relationships for advertising and promotional purposes regarding benefits or advantages of third-party companies, always communicated through AMARA. These messages will be based on cooperation agreements in the following sectors: leisure, travel, culture, cards and payment methods, automotive, transportation, insurance, distribution and financing, gifts, fashion, home, and technology.
• Legal basis for processing: Art. 6.1.a) GDPR – The data subject has given clear and explicit consent for the processing of their personal data for one or more specific purposes.
• Data processed for this purpose: Identification and contact data (name, surname, identity documents, postal and/or email address, phone number, image, voice, etc.).

Purpose 4 – Generating profiles with internal information.

• Goal Description: To create a commercial profile of the interested party with exclusive internal information obtained from the development of contractual relationships for products and services that the interested party has agreed upon. This includes the ability to make automated decisions based on the generated information to make specific offers, send tailored advertising messages, and resolve or refuse to negotiate products and/or services. Profiling with data from internal sources may involve operations to optimize the provision of services offered by AMARA, improving their quality. Consequently, consumers receive commercial messages of one kind or another depending on the analysis. Despite the above, regarding decision-making, the interested party has the right to human intervention from AMARA, asserting what they deem appropriate to express their viewpoint, protect their rights or interests in accordance with applicable law, and oppose the decisions made. Data processed in this sense will always correspond to the current situation of the interested party.
• Legitimacy Basis: Article 6.1.f) GDPR - Processing is necessary for the legitimate interests pursued by the data controller. AMARA has conducted a detailed assessment of the priority of the rights and freedoms of the data subjects, performing an in-depth assessment of the legitimate interest exceeding the minimal interference arising from the fundamental right to the protection of personal data of the individuals affected by data processing. For more information, you can consult with the Data Protection Officer (DPO) via the following email: dpo@amaranzero.com
• Data Processed for this Purpose: Identification and contact data (name, surname, identity documents, postal and/or email address, phone number, image, voice, etc.), personal characteristics (marital status, date of birth, nationality, gender, etc.), social circumstances, transactions of goods and services, other categories of data, and data obtained from the use of the service.

Goal 5 – Generating profiles with external information.

• Goal Description: To create a commercial profile of the interested party with information of an exclusively external nature for sending commercial messages from third parties to interested parties with the aim of promoting products and/or services of third parties. These are related to the following sectors: leisure, travel, culture, cards and payment methods, automotive, transport, insurance, distribution and financing, gifts, fashion, home, and technology.
• Legitimacy Basis: Article 6.1.a) GDPR – The data subject gives explicit and unequivocal consent to the processing of their personal data for one or more specific purposes.
• Data Processed for this Purpose: Identification and contact data (name, surname, identity documents, postal and/or email address, phone number, image, voice, etc.).

Goal 6 – Customer service provision.

• Goal Description: To respond to requests, inquiries, complaints, or claims from the interested party arising from the use of products and/or services offered by AMARA.
• Legitimacy Basis: Article 6.1.b) GDPR - Processing is necessary for the performance of a contract to which the data subject is a party or for the implementation of pre-contractual measures at their request.
• Data Processed for this Purpose: Identification and contact data (name, surname, identity documents, postal and/or email address, phone number, image, voice, etc.), and data obtained from the use of the service.

Goal 7 – Management and control of the satisfaction of the interested party.

• Goal Description: To track and control the satisfaction of the interested parties by conducting surveys on the quality and satisfaction of the products and/or services offered on the market by AMARA.
• Legitimacy Basis: Article 6.1.f) GDPR - Processing is necessary for the legitimate interests pursued by the data controller. AMARA has conducted a detailed assessment of the priority of the rights and freedoms of the interested parties, performing an in-depth assessment of the legitimate interest exceeding the minimal interference arising from the fundamental right to the protection of personal data of the individuals affected by data processing. For more information, you can consult with the Data Protection Officer (DPO) via the following email: dpo@amaranzero.com
• Data Processed for this Purpose: Identification and contact data (name, surname, identity documents, postal and/or email address, phone number, image, voice, etc.).

Goal 8 – Servicing for compliance with legal obligations.

Goal Description: Compliance with legal obligations imposed on AMARA in any order, such as financial matters, issues related to fraud, health, or safety. This may include, depending on the case and closely related to the previous goal, responding to judicial and administrative orders related to specific interested parties (e.g., notifications to the "Executive Service of the Commission for Preventing Money Laundering and Terrorist Financing" to prevent money laundering and financing for terrorist purposes or to the "National Commission for Markets and Competition").

Legitimacy Basis: Article 6.1.c) GDPR – Processing necessary for compliance with a legal obligation applicable to the data controller. AMARA has conducted a detailed assessment of the priority of the rights and freedoms of the data subjects, performing an in-depth assessment of the legitimate interest exceeding the minimal interference arising from the fundamental right to the protection of personal data of the individuals affected by data processing. For more information, you can consult with the Data Protection Officer (DPO) via the following email: dpo@amaranzero.com

Data Processed for this Purpose: Identification and contact data (name, surname, identity documents, postal and/or email address, phone number, image, voice, etc.), social circumstances, transactions of goods and services, other categories of data, or data obtained from the use of the service.

Goal 9 – Management and control of visits to the offices.

Goal Description: Personal data of users interested in visiting our offices will be processed to handle the request made by the user and, when appropriate, to perform actions necessary in connection with the organization and management of visits to our offices as requested.

Legitimacy Basis: Article 6.1.b) GDPR - Processing necessary for the performance of a contract to which the data subject is a party or for the implementation, at their request, of pre-contractual measures, and Article 6.1.c) GDPR – Processing necessary for compliance with a legal obligation applicable to the data controller.

Data Processed for this Purpose: Identification and contact data (name, surname, identity documents, postal and/or email address, phone number, image, voice, etc.).

Goal 10 – Providing advertised job positions.

Goal Description: Receiving and analyzing all personal data (resumes, ID cards, qualifications, etc.) provided during the application process for a job or internship offer offered by AMARA, whose data will be included in a processing record owned by you.

Legitimacy Basis: Article 6.1.b) GDPR - Processing necessary for the performance of a contract to which the data subject is a party or for the implementation, at their request, of pre-contractual measures.

Data Processed for this Purpose: Identification data (name and surname, ID card), contact data (email address, phone number, postal address, etc.), personal characteristics (date of birth, nationality, etc.), academic and professional data (diplomas, training, and professional experience), employment data (profession, workplace, etc.).

Goal 11 – Providing potential future job positions.

Goal Description: Receiving and analyzing all personal data (resumes, ID cards, qualifications, etc.) provided by the interested party for future job positions or internship offers that AMARA or AMARA Group companies may offer.

Legitimacy Basis: Article 6.1.a) GDPR – The data subject gives explicit and clear consent to the processing of their personal data for one or more specific purposes.

Data Processed for this Purpose: Identification data (name and surname, ID card), contact data (email address, phone number, postal address, etc.), personal characteristics (date of birth, nationality, etc.), academic and professional data (diplomas, training, and professional experience), employment data (profession, workplace, etc.).

Regarding these purposes, whose legitimacy basis is identified as the legitimate interest of AMARA, the interested party may contact dpo@amaranzero.com for the purpose of obtaining more information about the conducted balancing (between the aforementioned interest and the right to the protection of personal data of the affected individuals).

Similarly, the interested party has the right to object to processing activities based on legitimate interest.

The types of data processed by AMARA may include, for example:

• Identification Data: such as name, surname, identity documents, postal and email address, phone number, image, voice, etc.
• Personal Characteristics Data: such as your marital status, family-related data, date of birth, nationality, gender, etc.
• Economic, Financial, and Insurance Data: such as your participation in pension plans, financial data related to salary payments, banking information, insurance data, taxes, and tax exemptions, etc.
• Social Circumstances Data: such as membership in clubs or associations, licenses, permits, etc.
• Academic and Professional Data: such as data related to your education and qualifications, work history, your identification as an interested party, etc.
• Transaction Data for Goods and Services: for example, compensations and allowances.
• Commercial Information Data: such as activities and businesses independent of the services they provide that could generate a conflict of interest.
• Data related to the commission of criminal or administrative offenses in cases necessary given the characteristics of the job to be performed.

What data is processed by AMARA and from what sources does it come?

The data processed by AMARA as a result of user interactions through our website comes from the following sources:

• Data provided by the user: This includes information provided by filling out forms provided by AMARA, through sending emails, or by any other means through which the user communicates with AMARA.

• Data generated as a result of browsing and using AMARA's websites: Information generated while navigating and using AMARA's websites by the user.

• Data generated as a result of the development, processing, and maintenance of the relationship established between the user and AMARA: Information arising from the ongoing relationship between the user and AMARA.

• Third-party data provided by the user: Information obtained from third parties, as supplied by the user.

• Data obtained from external sources: Information received from external sources such as social networks.

To whom is the Personal Data disclosed? Is there an international transfer?

The interested party is informed that personal data may be disclosed to the entities listed below for the purpose indicated in each specific case:

Recipient 1: If necessary, to companies within the AMARA group, which can be verified on the website for administrative purposes and for managing relationships with customers, based on AMARA's legitimate interest for this purpose. The legitimate interest for the stated purpose of disclosure would be to ensure better organization and optimization, as well as unified management of the business group's resources in cases where internal coordination becomes necessary for the effective execution of the activities.

Recipient 2: Government administrations and Judicial administration.

Recipient 3: Companies and organizations collaborating with AMARA for organizing, managing, and/or promoting applications, contests, events, promotions, or lotteries, in case the Participant has decided to register and/or participate in them.

Recipient 4: Service providers engaged by AMARA, who, when applicable, are hired to measure web traffic and user behavior through cookies and similar systems, by the Cookie Policy, and will act as data processors.

How long do we retain your data?

AMARA will retain your data for the time necessary to provide the requested service and/or to achieve the intended processing purpose. Subsequently, as long as the user has not exercised their right to deletion, their data will be stored for the legal periods applicable in each case, taking into account the nature of the data and the purpose of processing.

In any case, the user can request detailed information regarding data retention periods applied by AMARA by contacting our Data Protection Officer at: dpo@amaranzero.com.

What personal data do you need to provide in each specific case?

AMARA informs users that when collecting personal data through forms accessible on our website, the user must provide at least the data marked with an asterisk (*). If at least such necessary data is not provided, AMARA will not be able to manage the provision of the service or respond to a request made by the user.

What assurances must you provide when providing your personal data?

The user guarantees that the provided data is true, accurate, complete, and up-to-date, taking responsibility for any damages or losses, direct or indirect, that may be caused as a result of non-compliance with this obligation.

In the event that the user provides data belonging to a third party, they guarantee that they have informed this third party about all aspects contained in this Privacy Policy and have obtained its consent to provide us with their data for the stated processing purpose. All this before providing data from a third party through any of our web pages.

AMARA informs you that, to provide your personal data in any way through our website, you must be of legal age. The user who provides data to AMARA through this website declares and guarantees that they are of legal age, taking full responsibility for this declaration.

What measures do we take to protect your personal data?

In response to AMARA's concern to ensure the security and confidentiality of your data, the necessary security levels to protect personal data have been adopted, and the technical means available have been installed to prevent the loss, misuse, alteration, unauthorized access, and theft of personal data provided through the website. In any case, it should be noted that Internet security measures are not impervious.

What are your rights regarding your personal data?

AMARA informs you that you have the right to receive confirmation of whether we process personal data related to you or not.

Likewise, you have the following rights over your personal data:

1. Access to Your Data: You have the right to access your data to know what personal data we process that affects you.

2. Request Correction or Deletion of Your Data: Under certain circumstances, you have the right to correct personal data that you consider inaccurate and that concerns you and that are processed by AMARA. You also have the right to request the deletion of your data when, among other reasons, the data is no longer necessary for the purposes for which it was collected.

3. Request Restriction of Processing of Your Data: Under certain circumstances, you will have the right to request that we limit the processing of your data, in which case we inform you that we will only keep the data for which you have requested restriction of processing for the exercise or defense of legal claims.

4. Data Portability: Under certain circumstances, you will have the right to receive personal data that concerns you and that you have provided to us in a structured, commonly used, and machine-readable format, as well as to transmit it to another data controller.

5. Object to the Processing of Your Data: Under certain circumstances and for reasons related to your particular situation, you will have the right to object to the processing of your data, in which case we will stop processing them unless we have compelling legitimate grounds or for the exercise or defense of legal claims.

Additionally, you can withdraw any consent you have given for the processing of your data without affecting the lawfulness of the processing based on the consent given before its withdrawal.

AMARA informs you that you can exercise your rights over your data through one of the following means:

1. By writing to AMARA NET ZERO BULGARIA EOOD, EIK 207399900, Sofia 1505, Oborishte district, 48 Sitnyakovo Blvd., Offices Serdika, floor 7, office 705b.
2. By writing to AMARA at the email address: dpo@amaranzero.com.

In both cases, it is necessary to verify the identity of the person exercising their rights by sending a copy of their ID card, personal identification number, passport, or equivalent document from both sides (front and back).

AMARA will provide the requested information within a maximum period of one month from receiving the request.

AMARA informs you that you can file a complaint with the Data Protection Authority responsible for data protection. However, in the first instance, you can file a complaint with the Data Protection Officer, the responsible person, or the department, who will resolve the complaint within a maximum of two months.