Information about the personal data controller:
GAME STUDIO PHANTOM Ltd. is a company registered under the Commercial Law of the Republic of Bulgaria with Unified Identification Code: 202788156, seat and address of management: Sofia, p.c. 1797, Mladost, bl. 92, entr. A, ap. 107, phone: +359899206223; e-mail: hello@decentgames.bg
Grounds on which we use your personal data and purposes for using your personal data
We process your personal data on the following grounds:
- the contract concluded between us and you in order to fulfill our obligations under it;
- explicit consent from you – the purpose is indicated for each specific case;
- in case of an obligation under law;
In the following sections you will find detailed information about the processing of your personal data depending on the grounds on which we process them.
FOR PERFORMANCE OF A CONTRACT OR IN THE CONTEXT OF PRE-CONTRACTUAL RELATIONS
We process your personal data in order to fulfill the contractual and pre-contractual obligations and to enjoy the rights under the contracts concluded with you.
We process your personal data with the following purposes:
- to establish your identity;
- for management and completion of your order and execution of a concluded contract;
- for preparation of a proposal for concluding a contract;
- to prepare and send an invoice for the services you use with us;
- to provide you with the necessary complete service, as well as to collect the amounts due for the used services;
- keeping correspondence in connection with an order, processing orders, reporting problems, etc.
- notification of everything related to the services you use with us;
- identify and/or prevent illegal actions or actions not corresponding to our terms of service;
Data we process on these grounds:
Based on the contract concluded between us and you, we process information on the type and content of the contractual relationship, as well as any other information related to the contractual relationship, including:
- personal contact details – contact address, email, phone number;
- identification data – full names, Bulgarian Uniform Civil Number (UCN/EGN) or national ID number of a non-Bulgarian citizen, gender, age group, permanent address;
- health condition;
- data on the orders placed;
- correspondence in connection with the overall service – e-mail, letters, information about your requests for troubleshooting, complaints, requests, feedback that we receive from you;
- credit or debit card information, bank account number or other banking and payment information in connection with payments made;
o other information such as:
- a customer number, code, or other identifier;
- demographic data;
- data on social media profile.
The processing of the specified personal data is obligatory for us so that we can conclude the contract with you and fulfill it. Without providing us with the above data, we would not be able to fulfill our obligations under the contract.
We provide personal data to third parties
We provide your personal data to third parties, and our main goal is to offer you quality, fast and comprehensive service. We do not provide your personal data to third parties until we are sure that all technical and organizational measures have been taken to protect this data and we strive to exercise strict control over the implementation of this purpose. In this case, we remain responsible for the confidentiality and security of your data.
We provide personal data to the following categories of recipients (personal data controllers):
- postal operators and courier companies;
- persons which, on assignment, maintain equipment, software and hardware used for personal data processing and necessary for the association’s activity;
- persons performing consulting services in various fields.
When we delete data collected on this ground
We delete the data collected on this ground 2 years after the termination of the contractual relationship, regardless of whether due to the expiration of the contract, cancellation or other grounds.
TO FULFILL LEGAL OBLIGATIONS
The law may provide for an obligation for us to process your personal data. In these cases, we are obliged to perform the processing, for example:
- obligations under the Law on Anti-Money Laundering Measures;
- fulfillment of obligations in connection with distance selling, off-site sales, provided for in the Law on Consumer Protection;
- providing information to the Commission for Consumer Protection or third parties provided for in the Law on Consumer Protection;
- providing information to the Commission for Personal Data Protection in connection with obligations provided for in the legislation for personal data protection;
- obligations provided for in the Law on Accounting and the Tax and Social Security Procedure Code and other related legal acts, in connection with the keeping of lawful accounting;
- provision of information to the court and third parties, in the framework of proceedings before a court, in accordance with the requirements of the legal acts applicable to those proceedings;
- age verification when shopping online.
When we delete data collected on this ground
The data collected in accordance with an obligation provided by law are deleted after the obligation for collection and storage of these data has been fulfilled or has ceased to exist. For example:
- under the Law on Accounting for storage and processing of accounting data (11 years);
obligations to provide information to the court, competent state authorities, etc. grounds provided for in the current legislation (5 years).
Providing data to third parties
When there is an obligation for us by law, it is possible that we provide your personal data to the competent state authority, natural or legal person.
UPON YOUR CONSENT
We process your personal data on this basis only upon your explicit, unambiguous and voluntary consent. We will not foresee any adverse consequences for you if you refuse your personal data to be processed.
Consent is a separate ground for the processing of your personal data; the purpose of processing personal data is stated in it, and is not covered by the grounds listed in this policy. If you give us the relevant consent and until its withdrawal or termination of any contractual relationship with you, we prepare suitable for you offers for products/services, performing detailed analyzes of your basic personal data.
Detailed analysis is a method of analysis that allows processing large volumes of data using statistical models and algorithms and others that involve the use of personal data, as well as processes of pseudonymization and anonymization of the same, in order to extract information about trends and various statistical indicators.
Data that we process on this ground:
On this ground, we only process data for which you have given us your explicit consent. The specific data are determined for each individual case. Usually this information includes email address, names, gender and age.
Providing data to third parties
On this basis, we may provide your data to marketing agencies, Facebook, Google or the like.
Withdrawal of consent
Given consent may be withdrawn at any time. Withdrawal of consent does not affect the performance of contractual obligations. If you withdraw your consent to the processing of personal data in any or all of the ways described above, we will not use your personal data and information for the purposes set out above. Withdrawal of consent shall not affect the lawfulness of the processing based on consent prior to its withdrawal.
To withdraw your consent, you only need to use our contact information.
When we delete data collected on this ground
We delete the data collected on this basis at your request or 12 months after their initial collection.
PROCESSING OF ANONYMIZED DATA
We process your data for statistic purposes, ie for analyzes in which the results are only a summary and therefore the data is anonymous. It is not possible to identify a specific person from this information.
Your data can also be anonymized. Anonymization is an alternative to deleting data. Upon anonymization, all personally identifiable items/items that allow your identification are permanently deleted. There is no legal obligation for anonymized data to be deleted, as they do not constitute personal data.
Why and how we use automated algorithms
For the processing of your personal data, we use partially automated algorithms and methods in order to continuously improve our products and services to adapt our products and services to your needs in the best possible way. This process is called profiling.
How we protect your personal data
To ensure adequate data protection of the company and its customers, we apply all necessary organizational and technical measures provided for in the Bulgarian Law on Personal Data Protection.
The association has established rules to prevent abuse and security breaches, which supports the processes of protection and security of your data.
For maximum security in the processing, transmission and storage of your data, we may use additional security mechanisms such as encryption, pseudonymization and more.
Personal data we have received from third parties
We do not receive data from third parties.
Consumer Rights
Each User of the site enjoys all rights to personal data protection under Bulgarian law and European Union law.
The user can exercise their rights by sending a message to our email.
Every User has the right to:
- information (in connection with the processing of their personal data by the controller);
- access to their own personal data;
- rectification (if the data is inaccurate);
- erasing of personal data (the right to be “forgotten”);
- restricting the processing by the controller or the person processing the personal data;
- data portability between individual controllers;
- objection to the processing of their personal data;
- the data subject has the right not to be the subject of a decision based solely on automated processing, including profiling, which has legal consequences for the data subject or similarly affects them significantly;
- right to judicial or administrative protection in case the data subject’s rights have been violated.
The user can request erasure if one of the following conditions is met:
- personal data are no longer needed for the purposes for which they were collected or otherwise processed;
- the user withdraws their consent on which the data processing is based and there is no other legal basis for the processing;
- the user objects to the processing and there are no legal grounds for the processing to take precedence;
- personal data have been processed illegally;
- personal data must be deleted in order to comply with a legal obligation under European Union law or the law of a Member State applicable to the controller;
- personal data have been collected in connection with the provision of information society services to children and the consent has been given by the child’s legal guardian.
The user has the right to restrict the processing of their personal data by the controller when:
- they dispute the accuracy of personal data. In this case, the processing restriction is for a period that allows the controller to verify the accuracy of the personal data;
- the processing is illegal, but the User does not want the personal data to be deleted, but instead requires restricting their use;
- the controller no longer needs the personal data for the purposes of processing, but the User requires them for the establishment, exercise or protection of legal claims;
- they object to the processing pending verification of whether the legal grounds of the controller take precedence over the interests of the User.
Right of portability
The data subject has the right to receive the personal data concerning them and which they have provided to the controller, in a structured, widely used and machine-readable format and have the right to transfer this data to another controller without hindrance from the original controller, provided that the processing is based on consent or a contractual obligation and is carried out in an automated manner. When exercising their right to data portability, the data subject is also entitled to direct data portability from one controller to another, where this is technically feasible.
Right to object
Users have the right to object to the controller against the processing of their personal data. The personal data controller of shall be obliged to terminate the processing, unless they prove that there are convincing legal grounds for the processing, which take precedence over the interests, rights and freedoms of the data subject, or for the establishment, exercise or protection of legal claims. In the event of an objection to the processing of personal data for the purposes of direct marketing, the processing should be terminated immediately.
Complaint to the supervisory authority
Each User has the right to file a complaint against illegal processing of their personal data to the Commission for Personal Data Protection or to the competent court.
Maintaining a register
We maintain a register of the processing activities for which we are responsible. This register contains all the information listed below:
- the name and contact details of the controller;
- processing purposes;
- description of the data subjects’ categories and of the personal data categories;
- the categories of recipients to whom the personal data are or will be disclosed,
- including recipients in third countries or international organizations;
- where possible, the deadlines for deleting the different categories of data;
- where possible, a general description of the technical and organizational security measures.