PERSONAL DATA PROTECTION POLICY AT KINO ARENA BULGARIA EOOD
ARENA CINEMA’S WEBSITE: WWW.KINOARENA.COM
Confidentiality and security
Dear customers,
Kino Arena Bulgaria EOOD[1], company ID number [EIK] 201356916 (Arena Cinema) respects the privacy of its customers and guarantees the maximum level of protection of their personal data processed upon online reservations/purchases of tickets, registrations of tickets in various games and promotions and other activities carried out upon and in relation to visits to Arena Cinema’s website.
The company aims to carry out its business in full compliance with the requirements of the Personal Data Protection Act and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).
This Personal Data Protection Policy has been prepared and is based on the Bulgarian and European legislation in force in the field of protection of personal data.
Kino Arena Bulgaria EOOD reserves its right to amend this policy. All amendments and supplementations to the Personal Data Protection will apply after the publication of its up-to-date content accessible via our website: www.kinoarena.com
The Personal Data Protection is applicable for your data if you are a natural person or a representative of a legal entity visiting Arena Cinema’s website at www.kinoarena.com and/or having a registration on this website. The policy will make it clear for you what information we process upon site visits, online reservation/purchase of tickets, registration of tickets in games and promotions on our website at www.kinoaren.com, for what purposes we use it and what rights you have as a data subject.
You can find full information about the protection of personal data according to the Bulgarian legislation on the website of the Personal Data Protection Commission at www.cpdp.bg.
Contact details
If you have any questions related to the processing of personal data you can contact us at: email: info@kinoarena.com
Types of data collected
Arena Cinema processes different types of personal data which may be received from the data subject, from third parties or which may be created by Arena Cinema while providing services to the customer.
Arena Cinema automatically collects and keeps information related to the use of the site such as for example: the pages of the site visited by customers, the websites redirecting the users to the site, users’ IP addresses, the type of Internet browser used by the users, the number of users who have seen a banner, etc. This information does not allow the identification of the specific user, and it is used to analyze user conduct, finding the efficiency of the advertising made, for statistical purposes as well as for improvement of the services offered on and via the Site.
Provision of personal data on part of customers is voluntary. Where in order to use a service or a functionality on the site the customers need to provide personal data the Company shall clearly designate whether the provision of certain data is mandatory (whether in the registration form, or in the specific general terms and conditions of a promotional campaign with prizes, etc.). Where the provision of data is designated as “Mandatory” this means that if the customer does not provide them (s)he may not use the service or the functionality of the site for which the provision of such data is required, including the service of online sale of cinema tickets or the participation in a game with prizes and receipt of prizes by a successful participant.
Upon the registration of the user on the website www.kinoarena.com, online sale of tickets, games, promotions and registration of tickets Kino Arena Bulgaria EOOD shall collect, process, use and keep the following personal data provided by the customer (as the list is not exhaustive and is subject to changes, which shall be clearly designated for the users of the website. Customer’s consent to the rules of the general terms and conditions and the personal data protection policy shall be explicitly demanded as the customer shall mark a field in case (s)he agrees.
User’s data in the PROFILE menu on the website www.kinoarena.com
Personal information in the PROFILE menu
● Sex
● First, Middle, Last Name
● E-mail address
● Telephone
● City/town
● Postal code
● Address
● Date of birth
● Education
● Job position
● Facebook profile
In the profile of each user information is collected about:
- Reservations made
● Tickets purchased
● Reservations cancelled
In user’s profile there is an option to fill in interests: music, games, books, etc.
1.1. User’s data upon reservation/purchase of tickets via the website
● e-mail address via which the reservation/purchase of the ticket by the customer is confirmed
1.2. User’s data upon registration of tickets (Games and Promotions)
- Ticket number
● First, Middle, Last Name
● Date of birth
● E-mail address
● Address
● Telephone
In relation to the receipt of prizes in excess of a certain value from games and promotions and in view of the fulfillment of Arena Cinema’s obligations under the tax legislation the provision of personal ID number [EGN]/alien’s personal ID number [LNCh] is required for the successful participants as well as information as to whether they are local or foreign persons within the meaning of article 4 and article 5 of the Individual Income Taxation Act;
And an address abroad for aliens local or foreign person
The customer gives his/her consent that the data stated by him/her in the online order for purchase of tickets may be used by Kino Arena Bulgaria EOOD for processing of customer’s order, remote performance of the contract and for communication with the customer if necessary.
Purposes of collection and processing of personal data
Kino Arena Bulgaria EOOD shall collect and process personal data in general for the following types of Purposes:
1) For conclusion of contracts with customers and for the fulfillment of the obligations under the contracts on part of Arena Cinema. Provision of data is upon request of the natural persons whose personal data are being processed and is voluntary – for that purpose of Arena Cinema certain personal data of the customer are needed (e.g. full name, address, contact data). Arena Cinema may require additional information depending on the nature of the services which are part of the contract (e.g. a personal ID number [EGN] or a personal number of the natural person; date of birth).
2) For the performance of a statutory obligation of Arena Cinema – where the processing of personal data is necessary for accounting before state authorities and other authorities – e.g. for tax purposes on the grounds of the requirements of the Accounting Act as well as for the performance of Arena Cinema’s obligations as an organizer of promotions and campaigns with prizes in excess of certain value where the Organizer is obliged to provide the awarded person with a certificate under article 45, paragraph 7 of the Individual Income Taxation Act regarding income from other sources under article 35 of the Individual Income Taxation Act, as well as to declare to the National Revenue Agency by using the Information Sheet under article 73, paragraph 1 of the Individual Income Taxation Act every awarded person by stating in the sheet the full name, personal ID number [EGN]/alien’s personal ID number [LNCh] or official National Revenue Agency number of the awarded person, and if the person is an alien within the meaning of article 5 of the Individual Income Taxation Act: the alien’s address abroad must also be declared.
3) Purposes where the processing of personal data is based on customer’s consent which must be explicitly given: e.g. for Sending messages (e-mails) for products and services - Kino Arena Bulgaria EOOD shall process personal data in order to send messages for the products and services used by the customer via e-mails. The messages (e-mails) deal with current promotions and offers as well as with information about forthcoming film titles, concerts and other alternative content at Arena cinema theatres.
4). Purposes where the processing of personal data is based on Arena Cinema’s legitimate interest as a controller: а) Disputes (legal and out-of-court): Establishment, exercise or defense of rights of Arena Cinema – Arena Cinema shall process the data of its customer in order to defend its rights in court proceedings, upon settlement of claims assisted by external lawyers, etc. This is valid for situations where personal data are being processed in relation to the administration of information related to legal disputes, court guarantees, petitions and court rulings.
b) Internal accounting, analysis and development of the products and services offered – Arena Cinema shall use the personal data of its customers in order to increase the quality of the trade service and in order to offer new, better and more innovative products.
c) Technical assistance for creation of an account and/or recovery of forgotten password for access to the website www.kinoarena.com
Customers’ rights
Each customer of Kino Arena Bulgaria EOOD has the following rights in relation to his/her personal data and may exercise any of them in person at the main office of Arena Cinema or by sending a letter or an e-mail to 3 Business Park Sofia Street, city of Sofia / info@kinoarena.com
1. Right to provide personal data, including the right to provide and update information about himself/herself to Kino Arena Bulgaria EOOD, including provision of personal data enabling the identification of the person;
2. Right to access to personal data: the right to receive information whether Kino Arena Bulgaria EOOD is processing his/her personal data, the categories of data and the categories of recipients to whom the data are disclosed or may be disclosed; the sources of such personal data, information about the logic of every automated processing of his/her personal data;
3. Right to rectification of personal data: in case that the person finds out that the personal data processed by Arena Cinema concerning him/her are inaccurate (s)he has the right to demand the rectification of such personal data (unless the person can rectify them on his/her own).
4. Right to erasure of personal data (right to be forgotten): under certain circumstances such as, for instance, if your customer personal data have been unlawfully processed or if (s)he has withdrawn his/her consent (if the processing of personal data is based on consent) (s)he has the right to demand and obtain the erasure of his/her personal data from Arena Cinema. The withdrawal of the consent may be submitted in the form of a declaration.
5. Right to restriction of processing: under certain circumstances such as, for instance, if the customer doubts the accuracy of his/her personal data or has objected to the legitimate purpose of the processing of his/her personal data (s)he has the right to demand from us restriction of his/her personal data until a solution is found.
6. Right to object to the processing: under certain circumstances such as, for instance, if the customer doubts our legitimate interest in processing his/her personal data (s)he has the right to object to such processing for reasons related to the specific situation.
7. Right to demand from Arena Cinema to notify third parties: the customer has the right to demand from Arena Cinema to notify the third parties to whom it has disclosed, in some precisely defined hypotheses, personal data of the customer, of any erasure, rectification or blocking of such personal data.
8. Right to object to the processing for direct marketing: the customer has the right to object to the processing of his/her personal data for the purposes of direct marketing;
9. Right to lodge a complaint with a controlling authority – the customer has the right, in case that (s)he thinks that a violation has been committed in relation to the processing of his personal data, to lodge a complaint with the Personal Data Protection Commission or directly to the competent court
Whenever the Data Subject wants to exercise his rights (s)he must provide a specific and detailed description of his/her request. Arena Cinema shall accordingly answer inquiries that contain sufficient details. When the rights are exercised Arena Cinema must verify the identity of the data subjects and to that end it may ask them to produce their ID card or other identity document which identifies beyond any doubt the respective person.
In the cases where an application for discontinuation of the processing and the use of personal data for the purposes of direct marketing is submitted it will suffice if the application contains the respective e-mail.
The company shall refuse access to personal data where such data do not exist or if the provision thereof is prohibited by a law or if it is impossible to separate the customer’s personal data from the personal data of other persons.
Recipients of personal data
Arena Cinema does not grant the right to use, does not sell, does not disclose, and does not share information about you (including personal data) to other persons or to non-related companies unless this is necessary in order to provide you with the services requested by you and when you have given your permission, or in any of the following hypotheses:
● The information is provided to contractual partners who work under assignment on part of Arena Cinema based on contractual relations and by virtue of confidential agreements. Such companies may use such information so that Arena Cinema can, for instance, provide advertising to its users. Nevertheless, such companies do not have the right to independently share such information.
- where Kino Arena Bulgaria EOOD is obliged to do so by the law;
- where such disclosure has been requested by the police, court authorities or by other state or municipal authorities that are competent to demand and collect such information according to and as per the procedure stipulated in the legislation in force;
- where the persons to whom personal data are provided for processing are natural persons or legal entities, public authorities, agencies or any other authority that processes personal data on behalf of the controller.
For the avoidance of doubt it is emphasized that when purchasing electronic tickets via the website of Arena Cinema the company does not have access to the card data of the customers at any time during the payment process. By filling in and sending an order for purchase of electronic tickets the customer agrees to the provision of his/her personal data (two names and an e-mail) and to their transfer to the bank servicing the company for the purposes of the processing of the payment transaction and the linking of such transaction to customer’s order. (As at the date of adoption of the Personal Data Protection Policy the servicing bank is First Investment Bank).
Arena Cinema follows all generally accepted standards of protection of the personal data provided at the time of receipt thereof and thereafter. Nevertheless, in cases of force majeure events, acts of third parties in bad faith (hackers) as well as where the customers of the Company make their personal information accessible to third parties, Arena Cinema has no responsibility for the security of such information or for any damages whatsoever that have occurred as a result of its disclosure.
Duration of Storage of Personal Data
Kino Arena Bulgaria EOOD shall store the personal data of data subjects in compliance with the statutory periods of storage and, if there are no such periods, as per the periods adopted by a resolution of the Company.
Processing, storage and use of data shall continue for as long as Arena Cinema has a reason for their storage – e.g. until the completion of a tombola and the receipt of the prizes, until the deletion of the registration of a user or until the withdrawal of his/her consent or until the expiration of the statutory period for tax purposes. The e-mails provided shall be stored for the purpose of direct marketing of Operator’s business for unlimited period or until the person who has provided them demands the destruction (erasure) thereof.
[1] A transliteration of Bulgarian abbreviation “EOOД” standing for a “wholly-owned limited liability company” – Translator’s Note.