DATA PROTECTION AND

PRIVACY POLICY

INTRODUCTION

This Privacy and Personal Data Protection Policy (“Policy”) governs the manner in which GALAXY INVESTMENT GROUP LTD collects, processes and stores your personal data in accordance with the requirements of the “General Data Protection Regulation” – Regulation (EU) 2016/679, the Personal Data Protection Act of the Republic of Bulgaria and other Bulgarian or international regulations.

The confidentiality of our users’ information is a top priority for us.

GALAXY INVESTMENT GROUP LTD, as a Personal Data Controller and in accordance with legislation and good practice, applies the required technical and organisational measures to protect the personal data of individuals. GALAXY INVESTMENT GROUPLTD complies with all the requirements of the new regulation by collecting only individuals’ data insofar as it is necessary, respectively: for the conduct of the company’s business; for the provision of our services; for the use of our websites and for marketing purposes.

This Policy describes how and what categories of personal data we gather from and about you, why we require it, to whom it may be transferred or disclosed, and how it is protected.

Definitions:

Please read this Policy carefully. By providing your personal data to GALAXY INVESTMENT GROUP LTD, whether electronically or on paper, you accept and agree to the practices described in this Privacy and Data Protection Policy.

If you have any questions about this Policy, please contact us, the Data Protection Officer; and if you do not agree with any of the terms contained in the Privacy Policy, we do not recommend that you use the products and services provided by GALAXY INVESTMENT GROUP LTD for which you must provide your personal data.

PRINCIPLES AND GROUNDS FOR COLLECTING, PROCESSING AND STORING PERSONAL DATA

To ensure that personal data is processed in accordance with legal requirements, personal data is collected and used lawfully, processing operations are secure, and GALAXY INVESTMENT GROUP LTD has taken the necessary precautions to ensure that personal data is not unlawfully disclosed. In compliance with the fundamental principles maintained by GALAXY INVESTMENT GROUP LTD, your personal data are:

GROUNDS FOR COLLECTING PERSONAL DATA:

as well as in other, legally established hypotheses.

PURPOSES OF PROCESSING PERSONAL DATA

In accordance with the requirements of Section I – Transparency and Conditions of Regulation (EU) 2016/679, GALAXY INVESTMENT GROUP LTD provides transparent information, communication and conditions for the exercise of the rights of data subjects under Article 12 of the Regulation.

GALAXY INVESTMENT GROUP LTD collects, processes and stores personal data for the following purposes:

TYPES OF DATA COLLECTED, PROCESSED AND STORED BY GALAXY INVESTMENT GROUP LTD.

For the purposes set out in section 4 of this policy, GALAXY INVESTMENT GROUP LTD collects, processes and stores the following categories of data:

Personal identification data: first name, surname, last name;

GALAXY INVESTMENT GROUP LTD does not collect: personal data relating to racial or ethnic origin; revealing political, religious or philosophical beliefs; genetic and biometric data;

STORAGE PERIOD OF PERSONAL DATA:
ERASURE

GALAXY INVESTMENT GROUP LTD will erase your personal data as soon as possible and in such a way that it can be reproduced or retrieved. GALAXY INVESTMENT GROUP LTD has adopted a corporate procedure for the erasure of personal data.

SOURCES OF PERSONAL DATA

The personal data collected by GALAXY INVESTMENT GROUP LTD is collected from the individuals to whom it relates; through the contact forms on the company’s websites; from third parties – our contractors and/or intermediaries, subject to the requirements of the Regulation.

RIGHTS OF PERSONS WHOSE DATA IS PROCESSED BY GALAXY INVESTMENT GROUP LTD

Right of access:

You have the right to request and obtain from GALAXY INVESTMENT GROUP LTD confirmation as to whether personal data relating to you is being processed; To obtain access to the data relating to you and information relating to the collection, processing and storage of your personal data; GALAXY INVESTMENT GROUP LTD shall provide you, upon request, with a copy of the personal data processed relating to you in electronic or other appropriate form; Providing access to the data is free of charge, but GALAXY INVESTMENT GROUP LTD reserves the right to charge an administrative fee in the event of repetitive or excessive requests;
Right to rectification:

You may rectify or complete inaccurate or incomplete personal data relating to you directly by making a request to GALAXY INVESTMENT GROUP LTD;

Right to erasure (right to be forgotten):

You have the right to request GALAXY INVESTMENT GROUP LTD to erase the personal data relating to you, and GALAXY INVESTMENT GROUP LTD is obliged to erase them without undue delay when the grounds provided for by law are present and if there is no other ground for lawful processing or lawful ground for refusal of the controller to erase the data; GALAXY INVESTMENT GROUP LTD shall not delete data for which it has a legal obligation to retain, including for defence, in respect of legal claims made against it or to prove its rights.

Right to restriction:

You have the right to require GALAXY INVESTMENT GROUP LTD to restrict the processing of personal data relating to you where: you contest the accuracy of the personal data, for a period that allows GALAXY INVESTMENT GROUP LTD to verify the accuracy of the personal data; the processing is unlawful, but you do not want your personal data to be erased, but only for its use to be restricted; GALAXY INVESTMENT GROUP LTD no longer needs the personal data for the purposes of the processing, but you require it for the establishment or defence of your legal claims; You have objected to the processing pending verification whether GALAXY INVESTMENT GROUP LTD’s legitimate grounds override your interests;

Right to portability:

You may, at any time, retrieve the data stored and processed about you in connection with your relationship with GALAXY INVESTMENT GROUP LTD by making a written request to the controller. Where it is technically feasible, you may request a direct transfer of the personal data to a controller designated by you;

Right to information:

You have the right to request to be notified of any action relating to rectification, erasure or restriction of processing;

Right to object:

You may object at any time to the processing by GALAXY INVESTMENT GROUP LTD of personal data concerning you where the processing is for the performance of a task carried out in the public interest or on the basis of official authority; for the purposes of the legitimate interests of the controller; for scientific or historical research purposes, or for statistical purposes, including profiling or processing for direct marketing purposes;
You have the right to refuse to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or significantly affects you. GALAXY INVESTMENT GROUP LTD does not carry out automated decision-making with data.

Right of appeal:

You have the right to lodge a complaint with the Data Protection Commission for breaches of Regulation (EU) No 2016/679 of 27 April 2016 and the right to an effective remedy against the DPA, controller or processor of your personal data;

Right to compensation:

You have the right to compensation for material or non-material damage suffered as a result of a breach of Regulation (EU) 2016/679.
In order to exercise the above-mentioned rights, you must make a request to GALAXY INVESTMENT GROUP LTD and verify your identity and the identity with the person to whom the data relate.

You may exercise your rights as follows:

At the office of GALAXY INVESTMENT GROUP LTD located at: 4003 Plovdiv, 5 Dunav Blvd.
By phone, mobile +359 32 92 4747
Via nternet: E-mail address: office@galaxy-bg.com; privacy@galaxy-bg.com
Website: www.galaxy-bg.com

WITHDRAWAL OF CONSENT TO THE PROCESSING OF YOUR PERSONAL DATA

In case you have given your consent to the processing of your personal data for one or more specific purposes, and you do not want all or part of the data to continue to be processed by GALAXY INVESTMENT GROUP LTD for a specific or all processing purposes, you may withdraw your consent at any time by making a free text request to GALAXY INVESTMENT GROUP LTD

TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES OR INTERNATIONAL ORGANISATIONS

Transfers of personal data that are processed or intended to be processed after the transfer to a third country or to an international organisation outside the EU shall only be carried out by GALAXY INVESTMENT GROUP LTD under the terms of the General Data Protection Regulation – Regulation (EU) 2016/679, subject to the conditions set out in Chapter V of the Regulation. GALAXY INVESTMENT GROUP LTD shall apply all provisions of the Regulation so as not to compromise the necessary level of protection of natural persons afforded by the Regulation.

In the event that GALAXY INVESTMENT GROUP LTD will transfer personal data to a third country or to an international organisation outside the EU, such transfer shall be carried out in accordance with the Company’s Non-EU Data Transfer Procedure and the data subjects shall be notified in advance and their Consent for the transfer of personal data shall be required.

PERSONS TO WHOM YOUR PERSONAL DATA IS PROVIDED

The persons, employees of GALAXY INVESTMENT GROUP LTD, who have access to your personal data are strictly defined in the Company’s Internal Regulations and Procedures for the processing of personal data, and the level of access to the various personal data registers is defined.

It is possible that GALAXY INVESTMENT GROUP LTD transmits your personal data to third parties who are involved in the processing or are processors of personal data, to administrative structures and bodies of executive power, etc., or to persons related to GALAXY INVESTMENT GROUP LTD (for the purposes of financial statements). In all cases, the transmission of personal data by GALAXY INVESTMENT GROUP LTD is carried out for the fulfilment of the processing purposes and in strict compliance with the requirements of Regulation (EU) 2016/679.

BREACHES AND NOTIFICATION OF BREACHES
GALAXY INVESTMENT GROUP LTD MAY NOT NOTIFY YOU IF:
CHANGES TO THE PRIVACY POLICY

GALAXY INVESTMENT GROUP LTD has the right to update, amend and supplement the Privacy Policy at any time in the future if the circumstances require it.

CONTACTS AND LINKS

In connection with the processing of your personal data, you can contact us using the following contacts:

Name: GALAXY INVESTMENT GROUP LTD

UIC: 115509755

Headquarters and registered office: 4003 Plovdiv, 5 Dunav Blvd.

Address for correspondence: Bulgaria, Plovdiv district, 4003 Plovdiv, 5 Dunav Blvd.

Phone: +359 32 92 4747

E-mail: office@galaxy-bg.com

Website: www.galaxy-bg.com

Contact details of the Data Protection Officer:

Address: country Bulgaria, Plovdiv district, 4003 Plovdiv, 5 Dunav Blvd.

Phone: +359 32 92 4747

E-mail: privacy@galaxy-bg.com

Name: Commission for Personal Data Protection

Headquarters and registered office:1592 Sofia, 2 Prof. Tsvetan Lazarov Blvd.

Headquarters and registered office: 1592 Sofia, 2 Prof. Tsvetan Lazarov Blvd.

Phone: +359 2 915 3518

E-mail: kzld@government.bg; kzld@cpdp.bg

Website: www.cpdp.bg

If you believe that we are violating your rights related to the processing of your personal data, and in accordance with the requirements of the “General Data Protection Regulation” – Regulation (EU) 2016/679, you have the right to lodge a complaint with the Data Protection Officer, lodge a complaint with a supervisory authority and seek judicial redress as follows:

If you wish to lodge a complaint about the processing of your personal data carried out by us, or about the way in which we have handled your complaint, you have the right to lodge a complaint with the Data Protection Commission and the Data Protection Officer (if such one is available).

You can make a complaint in one of the following ways:

  1. In person, on paper, at the office of the CPDP at 1592 Sofia, 2 Prof. Tsvetan Lazarov Blvd.
  2. By letter addressed to: 1592 Sofia, 2 Prof. Tsvetan Lazarov Blvd., Personal Data Protection Commission.
  3. By fax to: 029153525.
  4. By electronic mail to the email address of the CPDP (kzld@cpdp.bg). In this case, your complaint must be in the form of an electronic document signed with an electronic signature (not scanned).
  5. Via the CPDP website at https://cpdp.bg/?p=pages&aid=6 in the manner described on the relevant page. In this case, your complaint must be in the form of an electronic document signed with an electronic signature.

In either case, the complaint should contain:

The CPDP provides a complaint form to the Commission (to assist and guide citizens) in relation to the misuse of personal data in the voters’ lists supporting the registration of political entities. The form can be downloaded from the following page: https://cpdp.bg/userfiles/file/Documents_2017/Forma_jalba_politicheski subekti.doc