Summary
On 25 May 2018 a new General Data Protection Regulation of the European Union (Regulation (EU) 2016/679, GDPR) shall enter into force. The regulation aims to ensure the protection of data of individuals from all EU Member States and to harmonize regulations for processing.
As a provider of software as a service "Browswave" AD (hereinafter the "Company" or "Browswave") meets all requirements of the new regulation by collecting only data of individuals insofar as necessary to provide the service. Browswave keeps the data responsibly and lawfully.
"Browswave" AD operates in accordance with the Personal Data Protection Act.and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
Information on the Controller
Name: Browswave AD
Company ID: 204458374
Headquarters: Bulgaria, Sofia 1225, ul. Taiga 14
Address of business: Bulgaria, Sofia 1225, ul. Taiga 14
Address for correspondence: Bulgaria, Sofia 1225, ul. Taiga 14
Email for correspondence on matters relating to your personal data rights: accounting@browswave.com
Information on the Competent Supervisory Authority
Name: Commission for Personal Data Protection
Headquarters: Bulgaria, Sofia 1592, bul. Prof. Tsvetan Lazarov 2
Address for correspondence: Bulgaria, Sofia 1592, bul. Prof. Tsvetan Lazarov 2
Email: kzld@government.bg, kzld@cpdp.bg
Telephone: +359 2915 35 18
Website: www.cpdp.bg
Basis for the Collection, Processing and Storage of Your Personal Data
Art. 1. (1) Browswave collects and processes your personal data in relation to the provision of specialized software and services for market research in application of an agreement between your company / your employer and Browswave and in relation to achieving and concluding such an agreement on the basis of Article 6, paragraph 1, Regulation (EU) 2016/679, and in particular on the following basis:
Fulfillment of the obligations of Browswave resulting from agreement with your company / your employer;
For the purposes of the legitimate interest of Browswave;
Compliance with the statutory obligation that applies to Browswave;
Expressly obtained consent from you as a user for specific purposes.
(2) Browswave is a data controller in respect to your data as a user of our services. In respect to the data that you process using our services Browswave acts as a data processor.
Purposes and Principles of the Collection, Processing and Storage of Your Personal Data
Art. 2. (1) Browswave collects and processes your personal data your company / your employer is providing in connection with the use of the services agreed between the two parties as well as in connection with concluding an agreement between the two parties, including for the following purposes:
achieving and concluding an agreement between your company / your employer and Browswave for provision of services, individualization of a party to such an agreement, achieving unanimity on changes to it, and its renewal;
ensuring implementation of the agreement between your company / your employer and Browswave to for provision of relevant services by Browswave;
creating a user profile to access these services;
providing full functionality in the provision of services;
protection of information security;
sending information messages about important changes in the service and the manner of use, recommendations for improving the use of the platform, new and improved functionalities and others;
improving the service and its individualization based on your needs and the needs of your company / your employer, incl. through selection and adjustment of modules and functionalities of the system, providing access to appropriate training materials and trainings;
providing technical support through ticket system, email communication or call center;
accounting purposes;
statistical purposes.
(2)Browswave observes the following principles in the processing of your personal data:
lawfulness, fairness and transparency;
purpose limitation;
relevance to the purposes of processing and data minimisation;
accuracy and timeliness of data;
storage limitation to the extent of the necessary for achieving the purposes;
integrity and confidentiality of processing and ensure an appropriate level of security of the personal data.
(3) When processing and storing personal data Browswave can process and store personal data in order to protect its legitimate interests as follows:
implementation of its obligations to the National Revenue Agency, Ministry of Interior and other state and municipal authorities.
Types of personal data collected, processed and stored Browswave
Art. 3. (1) Browswave performs the following operations with personal data for the following purposes:
Аchieving and concluding a commercial transaction (аgreement) with a client or partner – the purpose of this operation is reaching an agreement with a trading partner or client and its administration.
Implementation of an agreement for the provision of specialized software as a service between your company and Browswave – the purpose of this operation is providing the agreed service.
Creating an user profile in execution of this agreement – the purpose of this operation is giving the user access to the service in accordance with the plan and configuration selected by your company / your employer and protection of information security. On the basis of a carried-out data protection impact assessment Browswave considers that the operation “Creating a user profile based on an agreement with a legal person” is permissible to perform and provides sufficient safeguards to protect the rights and legitimate interests of the data subjects in accordance with the requirements of GDPR.
Sending information messages – the purpose of this operation is administering the process of sending messages to the clients, concerning important changes in the service, manner of use, improvements or changes to the functionalities and expiring services, in accordance with the service provision agreement.
(2) Browswave processes the following categories of personal data and information for the following purposes and for the following reasons:
Your identification data – 1) name and surname, 2) email, 3) job function, 4) company / employer, 5) telephone number, 6) IP address.
Purpose for which this data is collected – 1) Creating a user profile and giving access to the services; 2) Contacting the user and sending information messages to her/him; 3) Concluding an agreement with the company represented by the user.
Basis for processing this data – With accepting the terms and conditions and buying the service the company, which is your employer, concludes an agreement with Browswave. On the basis of this agreement Browswave processes your personal data – Article 6, paragraph 1, letter b), Regulation (EU) 2016/679.
Other data processed by Browswave – 1) IP address from which you access our website or your user profile, 2) cookies when you log into your user profile.
Purpose for which this data is collected – Improving the security of service and protection against unauthorized access, localization of the interface, ensuring the proper functioning of the system and saving your work session, statistics.
Basis for processing this data – The processing is necessary for the fulfillment of an agreement to which your company / your employer is a party – Article 6, paragraph 1, letter b), Regulation (EU)2016/679. Until creating a user profile the IP address is collected for the purposes of the legitimate interests pursued by the controller – Article 6, paragraph 1, letter f), Regulation (EU) 2016/679.
(3) Browswave does not collect and process personal data that relates to the following:
revealing racial or ethnic origin;
revealing political, religious or philosophical beliefs or trade union membership;
genetic and biometric data, health data or data concerning a natural person's sex life or sexual orientation.
(4) Personal data is collected by Browswave from the persons to whom it relates.
(5) The Company does not engage in automated decision-making based on personal data.
Storage period for personal data
Art. 4. (1) Browswave stores your personal data for a period not longer than the existence of your profile. After this period Browswave due cares to delete and destroy all your data without undue delay.
(2) Browswave notifies you in the event that the period for which your personal data is stored needs to be extended in view of the fulfilment of the purpose, implementation of the agreement with your company / your employer, with a view of the legitimate interests of Browswave or otherwise.
(3) Browswave stores personal data that it is required to keep under applicable law for the period which may not exceed the period of existence of your profile.
Transmission of your personal data processing
Art. 5. (1) Browswave may at its own discretion transfer part or all of your personal information to personal data processors in fulfilment of the purposes of processing in strict compliance with the requirements of Regulation (EU) 2016/679.
(2) Browswave notifies you in case of an intention to transfer part or all of your personal data to third countries or international organizations.
Your rights in relation to the collection, processing and storage of your personal data
Withdrawal of consent to the processing of your personal data
Art. 6. (1) If you do not want all or part of your personal data you have given consent to be processed for a specific purpose or purposes continue to be processed by Browswave for this purpose or purposes you can at any time withdraw your consent to processing via the form for giving and withdrawal of consent or via free text written request to Browswave.
(2) Browswave may ask you to certify your personal identity and the identity between you and the person to whom the data relate.
Right of access
Art. 7. (1) You have the right to request and to obtain from Browswave confirmation as to whether or not personal data concerning you are being processed.
(2) You have the right to access to personal data related to you and the information relating to the collection, processing and storage of your personal data.
(3) Upon request, Browswave shall provide to you a copy in electronic or other appropriate form of your personal data undergoing processing.
(4) Providing access to data is free, but Browswave reserves the right to charge an administrative fee in case of recurrence or excessiveness of requests.
Right to rectification or completion
Art. 8. You may rectify or complete inaccurate or incomplete personal data relating to you via free text written request to Browswave at the address or email for correspondence as listed in section "Information on the Controller".
Right to erasure (“right to be forgotten”)
Art. 9. (1) You have the right to request from Browswave the erasure personal data related to you and Browswave has the obligation to erase them without undue delay where one of the following grounds applies:
the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
You withdraw withdraw your consent on which the processing is based, and where there is no other legal ground for the processing;
You objects to the processing, including for the purposes of the direct marketing, and there are no overriding legitimate grounds for the processing;
the personal data have been unlawfully processed;
the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which Browswave is subject;
the personal data have been collected in relation to the offer of information society services.
(2) Browswave is not obliged to erase the personal data if they are stored and processed:
for exercising the right of freedom of expression and information;
for compliance with a legal obligation which requires processing by Union or Member State law to which Browswave is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in Browswave;
for reasons of public interest in the area of public health;
for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes;
for the establishment, exercise or defence of legal claims.
(3) To exercise Your “right to be forgotten” you must submit a written request to Browswave to the address or email for correspondence as listed in section "Information on the Controller", and certify to Browswave your personal identity and the identity between you and the person to whom the data relate, and, for purposes of certification, present your identity document (ID card or passport) and, if necessary, enter your login credentials in the user profile of the person to whom the data relate.
(4) Browswave does not delete the data which it has a legal obligation to keep, including for the purpose of defence of legal claims against the controller or proof of the controller’s rights.
Right to restriction of processing
Art. 10. You have the right to obtain from Browswave restriction of processing where one of the following applies:
the accuracy of the personal data is contested by You, for a period enabling Browswave to verify the accuracy of the personal data;
the processing is unlawful and You oppose the erasure of the personal data and request the restriction of their use instead;
Browswave no longer needs the personal data for the purposes of the processing, but they are required by You for the establishment, exercise or defence of legal claims;
You have objected to processing pending the verification whether the legitimate grounds of Browswave override your interests.
Right to data portability
Art. 11. (1) You may at any time download the personal data concerning You, which are stored and processed in connection with the use of the services of Browswave, with a request by email.
(2) You may request from Browswave to transmit Your personal data directly to another controller, where technically feasible.
Right to obtain information
Art. 12. You may request from Browswave to inform you about all recipients to whom the personal data have been disclosed for which rectification or erasure of personal data or restriction of processing has been requested. You must submit a written request to Browswave to the address or email for correspondence as listed in section "Information on the Controller". Browswave may refuse to provide this information if this proves impossible or involves disproportionate effort.
Right to object
Art. 13. You may at any time object to processing by Browswave of personal data concerning you, including if processing for the purposes of profiling and direct marketing.
Your rights in the case of a personal data breach
Art. 14. (1) If Browswave detects a personal data breach which is likely to result in a high risk to Your rights and freedoms, Browswave shall communicate to You without undue delay the nature of the personal data breach and the measures taken or to be taken .
(2) Browswave is not required to notify you if:
it has implemented appropriate technical and organisational protection measures to the personal data affected by the personal data breach;
it has taken subsequent measures which ensure that the high risk to Your rights and freedoms is no longer likely to materialise;
notification would involve disproportionate efforts.
Persons to whom your personal data is provided
Art. 15. Following a request filed by your company / your employer and in application of the agreement between the two sides Browswave transmits the necessary information to the relevant Processor who processes your data for the purpose of providing the agreed services and administration of the agreement.
Art. 16. Browswave does not transfer of your data and to third countries. Exception is the case when your company / your employer has requested the creation of user profiles of individuals situated in a third country – in this case your personal data is visible to those individuals within your company / your employer.
Other provisions
Art. 17. In case of violation of your rights under the above policy or under applicable data protection laws, you have the right to file a complaint with the Commission for Personal Data Protection as follows:
Name: Commission for Personal Data Protection
Headquarters: Bulgaria, Sofia 1592, bul. Prof. Tsvetan Lazarov 2
Address for correspondence: Bulgaria, Sofia 1592, bul. Prof. Tsvetan Lazarov 2
Email: kzld@government.bg, kzld@cpdp.bg
Telephone: +359 2915 35 18
Website: www.cpdp.bg
Art. 18. You may exercise any of the rights relating to the protection of your personal data through the dedicated forms provided by Browswave or by filing a free form written requests stating you claim and identifying you as the data holder. Your claims may be forwarded to the Browswave address or email address for correspondence:
Name: Browswave AD
Company ID: 204458374
Headquarters: Bulgaria, Sofia 1225, ul. Taiga 14
Address of business: Bulgaria, Sofia 1225, ul. Taiga 14
Address for correspondence: Bulgaria, Sofia 1225, ul. Taiga 14
Email for correspondence on matters relating to your personal data rights: accounting@browswave.com
Website: www.browswave.com
Art. 19. If the consent concerns a transfer, the Controller shall describe the possible risks of such transfers of data to third countries due to the absence of an adequacy decision and appropriate safeguards.
Art. 20. (1) When you or your company / your employer instructs Browswave to process personal data of a third party for the purpose of using the service, Browswave acts as Processor.
(2) In the cases referred in paragraph 1, Browswave only acts on your instruction as the user of the service and in so fas as it can have oversight on the personal data you are processing. Browswave has no control over the content and data that you, as the user of the service, choose to upload to the service (including whether or not this data includes personal data). In this case, Browswave has no role in the decision process as to whether the user is using the service to process personal data, for what purposes and whether they are protected. Accordingly, Browswave's liability in this case is limited to 1) compliance with the user's instructions under the agreement and the terms and conditions, and 2) provision of information about the service and the functionalities via its interface.
Cookie Policy
The web-based service of Browswave uses cookies that are important to its correct operation. When you sign in to your Browswave profile, you accept the use of cookies.
Basis for the Collection, Processing and Storage of Your Personal Data
These cookies are necessary for the proper functioning of and convenience of work with the service. For example, with these cookies, we save your session on our website so that you do not have to enter a username and password continuously.
You can change the cookie settings for the cookies you get from our site in the browser you are using. Keep in mind that if you restrict certain types of cookies, our site may not work properly and you may not be able use its full functionality.
Security measures taken by Browswave with regard to the security of the personal data you store on our infrastructure?
Browswave treats very seriously the measures it takes to ensure the security of all types of information, including personal data, on its infrastructure. These measures include but are not limited to encryption, strict control of electronic data access, strict control of physical access to the servers on which the data are stored, thorough verification of the identity of the persons to whom such access is granted.