Privacy Policy

Privacy and Personal Data Protection Policy of Winners Group EOOD

Winners Group EOOD (“the Company”, “we”, “us”) is a company operating on the Bulgarian market in the provision of insurance intermediation services as an insurance broker. In carrying out our commercial activity, the protection of your data is a key priority for us, and we therefore strive to process it while keeping the data to the necessary minimum and limiting the periods for which it is stored, applying appropriate technical and organisational measures for its security. We value the inviolability of your life and health and the confidentiality of your data.

This Privacy and Personal Data Protection Policy (the Policy) is intended to provide you with general information on how we process personal data and what types of personal data we process (and, respectively, collect from and about you), why we need them, to whom they may be provided or disclosed and for what period of time they will be stored. Please read this Policy carefully and do not hesitate to contact us – using the contact details provided – should you have any further questions concerning the Company’s personal data processing activities or your rights as data subjects.

1. Personal data controller

The capacity of “personal data controller” is held by the person who, alone or jointly with another person, determines the purposes for which personal data will be processed (collected, used and stored) on paper or in electronic form.

The Company will act as the controller of your personal data where there is a basis for processing them, for example in connection with applying for a job with us; with your employment relationship with the Company; with the performance of the official function or activity directly assigned to you; with the satisfaction of, or defence against, your claims against the Company; or with the pursuit of other lawful/legitimate interests of the Company.

In certain cases, the Company may also process your personal data in its capacity as a joint controller with other personal data controllers that also lawfully process information about you, and in its capacity as a processor – where such processing has been entrusted to the Company. In such cases, the Company will continue to take care of the security and confidentiality of your data.

2. What types of personal data does the Company process?

Personal data processed

In connection with our activity as an insurance broker administering insurance relationships, we process only those of your personal data that are required under the Bulgarian legislation in force. In this regard, we would like to inform you that where the insured person / beneficiary under an insurance policy is a minor child (a natural person under 14 years of age), we will require the presentation of a document certifying the child’s parents (such as a birth certificate) and the presentation of an identity document of the parent(s). In certain circumstances, we may also process personal data of your spouse/partner which you have provided to us for the purposes of the legal relationship and to the processing of which you have consented. We process more personal data about you:

• when you complete an application for taking out insurance – because we aim to provide you with a better, more accessible and effective service that enables you to choose the best insurance product;
• when an insurance contract is concluded – because we must fill in all the data about you required by the insurer, in your capacity as policyholder and/or insured person, which the insurer requires for the purposes of the insurance relationship;
• when examining your complaints/requests/grievances and resolving disputes with you – because it is important to us to take an individual approach to your requests and complaints and to meet your expectations and needs in the best possible way;
• when establishing contractual relations with you or with a natural or legal person whom you represent – because it is important to us to verify that the person who, by signing the relevant contract or document addressed to us or prepared in connection with certain relations with us, and by assuming certain rights and obligations for themselves or for a third party, is indeed the person holding the power of representation;
• when conducting business contacts with you – where you yourself have provided us with contact details in connection with our current or possible future business ventures, or where your contact details have been provided to us by your employer in connection with the official functions you perform.

In view of the above, depending on the purposes of the processing, the Company may process (including collect and use) various types of personal data about you, for example:

• Names
• Address (permanent, current)
• Personal identification number or other identification number
• Date of birth
• Health data
• Copy of identity document
• Identity document details
• Telephone numbers
• Email addresses
• Traffic data
• Your location data
• IP address data
• Video images.

The Company applies the principle of data minimisation directly and immediately. The types of personal data processed have been determined in accordance with the specific nature of the Company’s activity and the risks directly associated with it, which make it necessary for the Company to take measures to safeguard the interests and legal rights of its clients – users of insurance services.

The Company does not collect or use from you – as clients – personal data revealing racial or ethnic origin, religious or philosophical beliefs or trade union membership, or data concerning the sexual orientation of a natural person, and you should therefore not disclose such data in the course of your communication with it.

Technical data processed which may identify you.

When you use our website winnersgroup.bg (“the Website”), the Company does not collect information about you which in itself constitutes “personal data”.

Nevertheless, it is important for you to know that, in connection with your visits to the Website, the Company collects information about you which may qualify as “personal data” solely and exclusively when processed in combination with other information about you collected in connection with the operation of the Website. Such is the information (data) that shows your user interests and behaviour. These other data are processed in connection with your behaviour as a user of the Website and/or in connection with the functioning of the Website and the adequate provision of the services you have requested that are provided through the Website (temporary data (cookies) and other technical data, recorded on your device through which you access the browser in which the Website operates). More specifically, such other data include the following information:

• information about your browser;
• information obtained from cookie files (cookies), the use of pixel tags and other technologies;
• demographic information and other information provided by you; and
• aggregated information from the use of the website.

These data are used by the Company to improve the operation of the Website, to improve the user interface of the Website, to facilitate the management of the pages, to obtain information about user habits and for targeted advertising.

We and our service providers – third parties – may obtain these other data in a variety of ways, including:

• Through your web browser: Most websites collect certain kinds of information, such as your IP address (i.e. the address of your computer on the internet), screen resolution, operating system type (Windows or Mac) and version, web browser type and version, and the time of the visit to the page(s). We use this information for purposes such as calculating the level of traffic to our website, diagnosing server problems and administering the website.
• Use of cookie files (cookies): “Cookies” are small text files that are saved on your computer or mobile device when you visit a website. They enable the website to remember your actions and preferences (such as username, language, font size and other display settings) over a period of time, so that you do not have to re-enter them each time you visit the site or move from one page to another. In itself, a cookie does not contain or collect information except when read by a server through a web browser; it may provide information for the purpose of achieving a more convenient service for the user by registering, together with the other data, the user’s preferences, by identifying errors and/or by collecting data for statistical purposes. These files will not harm your computer, and they allow us to recognise your computer and to collect information such as browser type, time spent on the website, pages visited, language preferences and the relevant country of the website.

Below is a description of the “cookies” files that we use on our website for the Republic of Bulgaria, what their function is, what data they collect and how we use them.

Some of the cookies we collect are “session cookies” – they are necessary for performing important functions of the Website, such as remembering a repeated form field within a single browser session. They also help to limit the need to transfer information over the internet. They are not stored on your computer and are deleted when you end your browser session. It is important that you are aware that we cannot guarantee the proper use of the Website without the use of cookies.

You may refuse to accept “cookies” through your browser settings. However, if you do not accept the use of these “cookies”, you may experience some inconvenience when using the Website and certain online services. For more information, see the “Cookie Management Policy” of the Website. You may also delete all cookies that are already stored on your computer, and you may also set most browsers to block them. If you do so, however, you may have to adjust some settings manually each time you visit a site, and in addition some services and functions may not work.

We also collect personal data about you when you fill in our contact form on our website.

3. How does the Company collect and process your personal data?

As already stated, the purposes for which the Company processes your personal data are:

• Provision of services by the Company and performance of the contracts concluded by it;
• fulfilment of your requests, petitions, applications and complaints addressed to the Company or related to its activity;
• protection of the rights and interests of the Company in connection with the performance of contracts to which you are a party or the representative of a party;
• compliance with legal obligations;
• pursuit of the lawful/legitimate interests of the Company related to the commercial activity and business processes it carries out;
• direct marketing;
• statistics, reporting and pre-contractual relations with the Company.

In order to achieve the stated purposes, the Company collects data about you in various ways, with the personal data most frequently processed being provided by you personally. There are also other sources from which the Company may obtain information about you, for example: from our partners; from your representatives; from your employer; from official registers (such as the Property Register, the Commercial Register, the Central Register of Special Pledges, the Central Credit Register and others); from databases of state authorities (the National Social Security Institute, the National Revenue Agency and others); and from our devices for video surveillance and/or for information connectivity to the INTERNET.

The Company processes your personal data by means of various processing operations (including, but not limited to: collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction), carried out manually and automatically. The type and manner of performing the specific processing operations depend on the purposes set for the processing and on the business processes related to those purposes. In the course of its processing activity, the Company may use processors, over which it exercises control as to compliance with the requirements for a high level of security and confidentiality of the personal data processed.

It is important to bear in mind that your consent to the processing of personal data is not the only legal basis on which the Company relies for its data processing activity. Therefore, the Company will lawfully process information about you even if you do not expressly consent to such processing or if, having given your consent, you have exercised your right to withdraw the consent so given to processing.

In this regard, we would like you to bear in mind that, for the purposes stated above, where your consent is not a necessary condition for the processing of your personal data, the Company may request that you provide information, or may disclose/provide such information to a third party, on a basis related to the pursuit of its lawful/legitimate interests (for example, with a view to preventing insurance fraud, with a view to the successful pursuit of our commercial activity and strategy, and so forth). The security of your data is a priority for us and, notwithstanding the need to pursue the lawful/legitimate interests of the Company, appropriate technical and organisational protection measures will be applied to protect your data.

The specific nature of the Company’s commercial activity requires the processing of personal data, and it is therefore important to bear in mind that, if you do not wish to provide us with some of the data we request, the Company may be unable to offer/provide you with the services you are interested in or the assistance you require, or to prepare proposals tailored to your specific needs.

4. Who will have access to your personal data?

The Company guarantees that your personal data will be processed only in accordance with the purposes stated above. In connection with those purposes, your data may be provided/disclosed/transferred to third parties acting as personal data controllers, for example:

• State and other public authorities (such as municipalities, the interior ministry authorities of the Republic of Bulgaria and of third countries, and other supervisory authorities);
• Courts, prosecution offices, notaries, private enforcement agents;
• Our counterparties in connection with the insurance relationship – insurers, reinsurers, other insurance intermediaries.

In connection with the stated purposes, we may also provide the data to persons acting as data processors or as joint controllers, in respect of whom the Company has the capacity of controller, such as:

• Other companies in our group;
• technical consultants, lawyers, accountants, as well as companies to which we entrust the performance of specific activities (for example IT support, etc.);
• Our Data Protection Officer, if that officer is an external consultant.

Apart from the above cases, we may provide your data to third parties:

• in the event of a planned or actual reorganisation of the Company, such as a merger, the sale of an enterprise, or any other disposal of part of our business or assets, including in insolvency proceedings;
• in order to comply with a legal obligation, including, for example, proceedings initiated on the basis of your report/complaint;
• in order to ensure the timely and accurate progress of proceedings for the investigation of an insured event.

As stated above, the security of your data is a priority for us, and the Company will therefore not disclose/provide/transfer your data to third parties who have no legitimate right to obtain information about you.

5. Where will your personal data be processed?

Your data are mainly processed on the territory of the Republic of Bulgaria and within the European Union. In rare cases, your personal data may also be processed outside the European Union, in which case there will always be contractual restrictions in respect of the confidentiality and protection of the data in accordance with the applicable requirements of the legislation in force in the Republic of Bulgaria. Such processing of personal data outside the territory of the European Union may occur when information services are used for communication (including at your initiative) – for example, by email or communication applications, where the email servers used are based on hardware devices located outside the territory of the European Union.

With regard to the place of processing of your data, it should be noted that the Company may also use “cloud” technologies for processing your data. In this regard, we would like you to know that the Company’s practice requires the conclusion of a contract with the providers of such technologies containing express instructions on the measures for the protection of the data and their confidentiality, which the providers are obliged to comply with. Where the processors engaged by the Company use such technologies for the purposes of their activity, the Company imposes requirements on the processors and monitors that they too apply, and require the providers of “cloud” technologies to apply, a high level of protection for the data processed by those technologies. Notwithstanding the above, it is important to take into account the fact that providers of “cloud” services and technologies apply enhanced protection measures by default, providing a significantly high level of data protection.

6. What are your rights in relation to your personal data?

The practices and methodologies we have adopted for data protection and for ensuring information security set the parameters of the established measures, which are aimed at:

• guaranteeing the confidentiality of information by applying a system of approved restrictions on access to and disclosure of information;
• ensuring the integrity of information by protecting against unauthorised modification or deletion of information;
• ensuring the availability of information through reliable and timely access to the information;
• achieving accountability of information – by introducing controls over access to and rights over the information systems.

In your capacity as a data subject, under Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“the General Data Protection Regulation”), you have the following rights:

• right of access to your data – upon your request, we will provide you with information about your data that are being processed;
• right to rectification of your data – if you consider that certain of your data that we process are no longer up to date or are incorrect for another reason, you have the right to request the rectification of those data that are being processed;
• right to erasure of your data (the “right to be forgotten”) – you have the right to request the erasure/deletion of the data we process about you, and we will comply with your request only if we no longer have a legal basis for processing your data. Accordingly, we may also comply with your request for erasure/deletion in part;
• right to restriction of processing – you may exercise this right only where you have contested the accuracy of your data being processed, in which case the restriction of processing may apply only for the period during which we verify the accuracy of your data; where the processing is unlawful but you oppose the erasure of the data; where we no longer need your data for the purposes of the processing, but you as a data subject require them for the establishment, exercise or defence of your legal claims; where you have objected to the processing, pending verification of whether the legitimate interests of the controller override your interests as a data subject;
• right to data portability – you may request that we transfer all or part of your data that are being processed and that you have personally provided to us, to you or to another controller, in a machine-readable format, where the processing of those data is based on your consent or on the performance of a contract and where the processing is carried out by automated means;
• right to object to the automated processing of your data, to processing by means of profiling and to processing for the purposes of direct marketing – we provide you with the opportunity to exercise this right at any time and entirely free of charge;
• right to be informed of security breaches – you have the right to be informed in a timely manner of any breach of the security of your data, and we will fulfil our obligation in this regard by publishing information on the Website about any such breach, and we may also send you information by email where you have provided us with an email address and it is correct;
• right to object to processing for the purposes of direct marketing – you have the right, at any time and free of charge, to change your marketing preferences and to withdraw consent already given to the processing of your personal data for the purposes of direct marketing, or to object to such processing;
• right to withdraw consent given to the processing of personal data – you have the right, at any time and free of charge, to withdraw consent you have already given to the processing of personal data. We would like you to know that your consent is not the only basis for processing your personal data; we may therefore continue to process your personal data after the withdrawal of your consent.

You may exercise the rights described by changing the settings of your browser or mobile application, insofar as this is technically possible, or by contacting us using the contact details set out below, by completing the Form for the Exercise of Rights under the General Data Protection Regulation, which you can find on the Website winnersgroup.bg, and submitting it on paper in person at the office at the Company’s address of management.

In view of the fact that the Company maintains contact (establishes legal relations) with various categories of persons and on various occasions (including in connection with your actual and indirect participation in certain events), the proper examination of the application for the exercise of rights you have submitted is directly linked to your accurately establishing the circumstances in which it became necessary for the Company to process your personal data.

When you exercise your rights as a data subject, the Company needs to request and process certain of your personal data for the purposes of establishing and verifying your identity. As a personal data controller, the Company is not only obliged to provide a means for the exercise of your rights, but is also obliged to ensure that those rights will be exercised only by the data subjects who are actually the holders of the relevant right provided for by the General Data Protection Regulation.

Your application for the exercise of rights will be examined in a timely manner, as a general rule within no more than 30 (thirty) calendar days, unless your request is specific and involves an in-depth examination of information. Nevertheless, our team will do what is necessary to inform you, by sending information by email, in the event of a delay in the examination of your application. Given that the Company places great value on the need for data protection, it has adopted and applies a procedure for the examination of applications for the exercise of rights under the General Data Protection Regulation, which also sets out the time limits for processing and responding when an application for the exercise of rights is submitted by a data subject.

In addition to the above, it is important that you are informed that, in certain rare circumstances (for example, the death of a data subject), you may also exercise the rights of another data subject. In such a case, you will be required to submit, together with the application (Form for the Exercise of Rights under the General Data Protection Regulation), documents certifying your relationship (kinship) with the data subject whose rights you wish to exercise.

7. How can you object to the processing of your personal data?

As we have stated, you have the right to object to the processing of your personal data by the Company or to stop the processing (including for the purposes of direct marketing). Once you have notified us of this wish, we will stop processing your personal data, unless such processing is permitted or justified on the basis of another legal ground for processing. If, in the course of the processing, we have disclosed your personal data to third parties, we will notify those persons without delay of the objection you have exercised.

8. How long does the Company store your personal data?

The period for processing your data is likewise determined in accordance with the purposes of the processing and with the statutory requirements for the retention of accounting and tax information. The determination of the specific period for storing your personal data depends directly on the type of relationship we have established with you and in connection with which we have processed personal data about you. Thus, for example, in connection with our activity consisting solely of presenting (introducing) a particular insurance product or providing an indicative insurance quotation, we do not usually collect or record your personal data (our employees may possibly become acquainted with your personal data if you present certain identification documents to them). Therefore, in such cases we will not store personal data about you. If, however, you have requested a personalised insurance quotation (without an insurance contract having been concluded), we will collect and store your personal data and will delete them after the expiry of one year from the date on which the data were received.

The Company has adopted and applies a retention schedule for all types of data that we process, and monitors compliance with it.

The Company will not store your personal data for longer than is necessary and will store them only in connection with the purposes for which they were collected.

9. How can you contact us?

Winners Group EOOD
Vertigo Business Tower, office 2.2, 109 Bulgaria Blvd, Triaditsa District, Sofia Municipality, 1404 Sofia.
Tel.: +359894404956

You can contact us by email at monika.bozhichkova@winnersgroup.bg or via the enquiry form published at winnersgroup.bg/contact.

In connection with the collection and processing of your personal data, you may also contact the Commission for Personal Data Protection (CPDP) at: 2 Prof. Tsvetan Lazarov Blvd, 1592 Sofia, www.cpdp.bg.

10. When is this Policy updated?

We review this Policy regularly. The current version can be found on our website: winnersgroup.bg, and we will notify you of any significant change that may concern you by publishing information about the changes. This Policy was last updated on 23.05.2018.