Privacy Policy

Last updated: 19.02.2025 year

1. INTRODUCTION

1.1. Welcome to https://violetaorientaldance.com (“the Website” or “the Web page”), created for the benefit and by order of “Badria Art” EOOD, UIC: 207989309, registered office and address of management: Sofia, “Manastirski Livadi” residential complex, “Boyan Petrov” Str. 4, contact phone: +359 898 204 147.

1.2. BY USING THIS WEBSITE YOU AGREE TO THE TERMS REGARDING THE COLLECTION, USE, AND DISCLOSURE OF YOUR PERSONAL DATA IN ACCORDANCE WITH THIS PRIVACY POLICY.

1.3. PLEASE READ THIS PRIVACY POLICY CAREFULLY BEFORE USING THIS WEBSITE. IF YOU HAVE ANY QUESTIONS REGARDING THIS PRIVACY POLICY, PLEASE CONTACT US AT INFO@VIOLETAORIENTALDANCE.COM
OR +359 887 750 088. IF YOU DISAGREE WITH ANY OF THE TERMS STATED IN THIS PRIVACY POLICY, YOU SHOULD NOT USE THIS WEBSITE.

2. PERSONAL DATA CONTROLLER

2.1. “Badria Art” EOOD (hereinafter referred to as “the Controller”) is a single-member limited liability company, UIC: 207989309, registered office and address of management: Sofia, “Manastirski Livadi” residential complex, “Boyan Petrov” Str. 4, contact phone: +359 887 750 088 and Website: https://violetaorientaldance.com.

3. SUPERVISORY AUTHORITY:

3.1. Commission for Personal Data Protection

Address: Sofia, 1592, “Prof. Tsvetan Lazarov” Blvd. 2

Contact details: 02/915 35 18; 02/915 35 15; 02/915 35 19; kzld@cpdp.bg
, http://www.cpdp.bg/

4. PURPOSES AND SCOPE OF THE PRIVACY POLICY

4.1. The Controller understands the concerns of visitors of this website regarding the protection of personal data and is committed to protecting personal data by applying all personal data protection standards in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons regarding the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC. Through this Privacy Policy, the Controller respects the privacy of natural persons and takes all necessary measures for the protection of personal data against unlawful processing by applying technical and organizational measures in line with modern technological achievements, providing a level of security appropriate to the risks related to processing and the nature of the data that needs protection.

4.2. With this Privacy Policy and in compliance with the requirements of Regulation (EU) 2016/679, the Controller provides information on:

• Purposes and scope of this Privacy Policy;
• Personal data collected and processed by the Controller;
• Purposes of personal data processing;
• Retention period of personal data;
• Mandatory and voluntary nature of personal data provision;
• Personal data processing;
• Protection of personal data;
• Recipients or categories of recipients to whom data may be disclosed;
• Rights of natural persons;
• Procedure for exercising rights;
• Right to object;
• Buttons, tools, and content from other companies;
• Changes in the Privacy Policy.

5. DEFINITIONS

5.1. For the purposes of Regulation (EU) 2016/679 and this Policy, the terms below have the following meanings:

5.1.1. Personal data means any information relating to an identified natural person or a natural person who can be identified (“Data subject”); a person who can be identified directly or indirectly by an identifier such as a name, identification number, location data, an online identifier, or by one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person.

5.1.2. Processing means any operation or set of operations performed on personal data or on sets of personal data, whether by automated or other means, such as: collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

5.1.3. Restriction of processing means the marking of stored personal data for the purpose of limiting its processing in the future.

5.1.4. Profiling means any form of automated processing of personal data involving the use of personal data to evaluate certain personal aspects relating to a natural person, particularly: analyzing or predicting aspects concerning that person’s job performance, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.

5.1.5. Controller means the natural or legal person, public authority, agency or other body which alone or jointly with others determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the Controller or the specific criteria for its nomination may be provided for in Union or Member State law.

5.1.6. Processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the Controller.

5.1.7. Recipient means a natural or legal person, public authority, agency or another body, to which personal data are disclosed, whether a third party or not. Public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law are not regarded as recipients; the processing of those data by those public authorities complies with the applicable data protection standards according to the purposes of the processing.

5.1.8. Third party means a natural or legal person, public authority, agency or body other than the data subject, the Controller, the Processor and persons who, under the direct authority of the Controller or the Processor, are authorized to process personal data.

5.1.9. Consent means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

5.1.10. Personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed.

6. PRINCIPLES RELATED TO THE PROCESSING OF PERSONAL DATA

6.1. The Controller follows these principles in the processing of personal data:

• Data are processed lawfully, fairly, and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”);
• Data are collected for specified, explicit, and legitimate purposes and are not further processed in a manner incompatible with these purposes;
• Data are adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (“data minimization”);
• Data are accurate and kept up to date where necessary (“accuracy”);
• Data are stored in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data are processed (“storage limitation”);
• Data are processed in a manner ensuring appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures (“integrity and confidentiality”).

7. PERSONAL DATA COLLECTED AND PROCESSED BY THE CONTROLLER

7.1. Processing special categories of personal data (“sensitive data”) The Controller does not collect nor process special categories of personal data, such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for identification purposes, data concerning health, sex life or sexual orientation. Natural persons should not provide such sensitive data to the Controller. If a natural person intentionally provides sensitive data, the Controller undertakes to erase them immediately.

7.2. Personal data collected directly from natural persons

7.2.1. Personal data provided by natural persons when they contact the Controller by phone
Natural persons provide personal data when contacting the Controller by phone. The phone number is published in the identification data section of this Privacy Policy and in the “Contacts” menu. When a person contacts the Controller by phone, the Controller collects and processes only the person’s name and phone number, and in some cases their email address. These data are processed solely for communication purposes. This processing is necessary for pre-contractual actions taken at the request of the data subject, such as providing further information on goods and services offered, with a view of entering into a possible contract. The Controller uses a phone service provider located in the Republic of Bulgaria.

7.2.2. Personal data provided by natural persons when using the Controller’s contact form
Natural persons provide personal data when contacting the Controller by sending a message via the contact form located in the “Contacts” menu. When a person sends a message using the contact form, the Controller collects and processes the person’s name, email address, and other information included in the message, such as address. These data are processed for the purposes of communication and record keeping. This processing is necessary for pre-contractual actions taken at the request of the data subject, such as providing further information on goods and services offered, with a view of entering into a possible contract.

7.2.3. Personal data provided when contacting the Controller by email
Natural persons provide personal data when contacting the Controller by email. The email address is published in the identification data section of this Policy and in the “Contacts” menu. When a person sends an email, the Controller collects and processes the person’s email address and other information provided in the email, such as name, phone number, address. These data are processed for the purposes of communication and record keeping. This processing is necessary for pre-contractual actions taken at the request of the data subject, such as providing further information on goods and services offered, with a view of entering into a possible contract.

7.2.4. Personal data provided by natural persons when contacting the Controller on Facebook
Natural persons provide personal data when contacting the Controller on Facebook using the Messenger service through the Controller’s Facebook page. When a person sends a message via Facebook Messenger, the Controller collects and processes the person’s name and other information included in the message. These data are processed for communication and record-keeping purposes. This processing is necessary for pre-contractual actions taken at the request of the data subject, such as providing further information on goods and services offered, with a view of entering into a possible contract. Facebook is an independent service provider located in the United States. This means that data provided may be stored on Facebook servers in the United States. Facebook’s privacy policy is published at: https://www.facebook.com/policy.php

7.2.5. Personal data provided by natural persons when contacting the Controller on Instagram
Natural persons provide personal data when contacting the Controller on Instagram using the Messages service through the Controller’s Instagram page. When a person sends a message via Instagram Messages, the Controller collects and processes the person’s name and other information included in the message. These data are processed for communication purposes. This processing is necessary for pre-contractual actions taken at the request of the data subject, such as providing more information on goods and services, with a view to entering into a possible contract. Instagram is an independent service provider located in the United States. This means data provided may be stored on Instagram servers in the United States. Instagram’s privacy policy is published at: https://help.instagram.com/519522125107875

7.2.6. Personal data provided when registering a user profile
Natural persons provide personal data when registering a user profile on the Website. Upon registration, the Controller collects and processes the person’s: first name and last name, email address, and phone number. The collection and processing of these data are necessary: – for entering into or executing a sale contract for goods and services where the person is a party; – for compliance with a legal obligation applicable to the Controller, such as issuing invoices.

7.2.7. Personal data provided when purchasing goods
Natural persons provide personal data when purchasing goods from the Website. Upon purchase, the Controller collects and processes the person’s: first name and last name, email address, phone number, address, payment details, comments, and ratings left on the Website regarding purchased products. The collection and processing of these data are necessary: – for entering into or executing a contract for goods and services where the person is a party; – for compliance with a legal obligation applicable to the Controller, such as issuing invoices.

7.2.8. Personal data provided when ordering services
Natural persons provide personal data when ordering services from the Website. Upon service order, the Controller collects and processes the person’s: first name and last name, email address, phone number, address, and payment details. The collection and processing of these data are necessary: – for entering into or executing a contract where the person is a party; – for compliance with a legal obligation applicable to the Controller, such as issuing invoices.

7.2.9. Personal data provided when submitting complaints
Natural persons provide personal data when submitting complaints or claims to the Controller. In such cases, the Controller collects and processes the person’s: first name and last name, email address, phone number, address and any other data needed to verify the complaint or claim, including the scope of damages suffered. The processing of these data is necessary for the legitimate interest of the Controller, such as establishing the validity of the claim, defending against legal proceedings and other authorities.

7.3. Personal data provided by third parties
The Controller normally does not obtain personal data from third parties. However, if the Controller has reasonable grounds to suspect infringement of intellectual property rights by an individual or legal person, the Controller reserves the right to acquire personal data from public registers such as: the Commercial Register, the EUIPO register of trademarks or other public sources, for the purposes of filing a claim for infringement. This processing is necessary for the legitimate interest of the Controller and/or for compliance with a legal obligation.

7.4. Automatically collected data

7.4.1. When visiting the Website, the Controller may automatically collect the following data:

• IP address of the device used to access the platform (typically used to identify the country or city of origin);
• Device type (computer, mobile phone, tablet, etc.);
• Operating system type;
• Browser type;
• Specific user actions, including pages visited, frequency and duration of visits;
• Date and time of visits.

7.4.2. The collection and processing of automatically collected data are necessary for the legitimate interest of the Controller, such as: facilitating the use of the Website and improving functionality.

8. COOKIES

8.1. Natural persons can get more information on how the Controller uses cookies by reading the Cookie Policy, published on the Controller’s Website.

9. PURPOSES OF PERSONAL DATA PROCESSING

9.1. The Controller collects and processes personal data provided directly from natural persons solely for the following purposes:

• Providing the service offered by the Controller and identifying individuals (future and current clients);
• Establishing communication via email and responding to inquiries;
• Executing obligations under contracts, including pre-contractual actions;
• Shipping purchased goods;
• Receiving and processing complaints;
• Accounting purposes;
• Statistical purposes.

9.2. The Controller collects and processes automatically collected personal data for the following purposes:

• Improving functionality of the Website;
• Generating anonymous statistical analyses on Website use;
• Administering the Website;
• Adapting Website preferences for visitors.

9.3. The Controller does not have the right to use personal data for purposes other than those specified in this section.

10. DATA RETENTION PERIOD

10.1. Inquiries and correspondence via email, Facebook, and Instagram: The Controller retains personal data and received messages for the time necessary to respond and fulfill the request, as well as for a period of one year following the response.

10.2. Personal data of individuals who purchased goods: data are stored for the time necessary to fulfill the contract and for ten years after contract execution, which is the legally established retention period.

10.3. Personal data of individuals who ordered services: data are stored for the time necessary to fulfill the contract and for ten years after contract execution, which is the legally established retention period.

10.4. Criteria for determining retention periods: In all other cases, the Controller retains personal data for a period no longer than necessary, taking into account these criteria: – legal obligations requiring continued processing; – current and future processing purposes; – existing contracts requiring processing; – necessity to contact the person again; – legal grounds allowing for continued processing; – any other legitimate reasons, such as the nature of the relationship.

11. MANDATORY AND VOLUNTARY NATURE OF PERSONAL DATA PROVISION

11.1. The requested personal data are aligned with the services offered and may be provided voluntarily. If an individual refuses to provide personal data:

• The Controller will not be able to provide the requested service and/or deliver ordered goods;
• The individual will not be able to complete the contact form;
• The individual will not be able to register a user profile;
• The individual will not be able to receive a newsletter.

12. PERSONAL DATA PROCESSING

12.1. The Controller processes the personal data of individuals using automated or non-automated means.

12.2. The Controller processes personal data independently or by assigning a Processor on its behalf, such as: hosting providers, accounting providers, marketing providers, analytics providers, Website traffic analysis services, and delivery companies.

13. PERSONAL DATA PROTECTION

13.1. The Controller takes all technical and organizational measures to protect personal data from accidental or unlawful loss, destruction, unauthorized access, alteration, or dissemination, including:

• All personal data provided are stored on secure and reliable servers;
• Identity verification is mandatory before providing requested personal data to the data subject;
• Secure and encrypted connection is provided when personal data are transmitted;
• Secure and encrypted connection is provided when logging into the user profile;
• The Controller never requests login credentials or passwords via email or any other correspondence.

13.2. If you need more detailed information on personal data protection measures, do not hesitate to contact us at +359 887 750 088 or INFO@VIOLETAORIENTALDANCE.COM
.

14. DATA RECIPIENTS

14.1. The Controller has the right to disclose processed personal data to the following categories of Recipients:

• To the data subjects;
• If required by law — to state authorities or regulatory bodies;
• To Processors working on behalf of the Controller (e.g., hosting providers, courier companies, accounting providers, marketing providers, payment providers);
• The Controller does not sell or provide personal data for commercial use to any third parties.

15. RIGHTS OF NATURAL PERSONS

15.1. Right of access: individuals have the right to obtain confirmation from the Controller as to whether personal data concerning them are being processed, and if so — access categories and data.

15.2. Right of rectification: individuals have the right to request correction of inaccurate personal data and completion of incomplete data.

15.3. Right to erasure (“Right to be forgotten”): individuals have the right to request the deletion of personal data without undue delay, when applicable under Article 17 of Regulation (EU) 2016/679.

15.4. Right to restrict processing: individuals may request restriction of the processing under Article 18 of Regulation (EU) 2016/679.

15.5. Right to data portability: individuals have the right to receive the personal data concerning them, provided by them, in a structured, commonly used, and machine-readable format when processing is based on consent or contractual obligations and carried out by automated means.

15.6. Right to object: individuals have the right to object at any time, on grounds relating to their specific situation, against the processing of personal data concerning them, when processing is based on legitimate interests, public interests, or direct marketing.

15.7. Right to withdraw consent: individuals may withdraw their consent for personal data processing at any time. Withdrawal does not affect lawfulness of processing based on consent prior to withdrawal. Individuals may withdraw consent by submitting a written request or by selecting the “unsubscribe” option included in each marketing newsletter.

15.8. Rights in relation to profiling: individuals have the right not to be subject to decisions based solely on automated processing, including profiling, which produce legal or similarly significant effects.

15.9. Right to receive notification in the event of a personal data breach, wherein the breach may result in high risk for the user’s rights and freedoms, in compliance with Regulation (EU) 2016/679.

15.10. Right to administrative and judicial protection:

• Right to lodge a complaint with the Supervisory Authority in their Member State of residence or place of alleged infringement;
• Right to an effective judicial remedy against the Supervisory Authority;
• Right to an effective judicial remedy against the Controller or Processor.

15.11. Right to compensation for material or non-material damages resulting from infringement of Regulation (EU) 2016/679.

16. PROCEDURE FOR EXERCISING RIGHTS

16.1. Individuals exercise their rights by submitting a written request to the Controller, either by mail at the address stated in this Policy or via email, including the following mandatory data:

• Name, address and other data identifying the requester;
• Description of the request;
• Signature, date of submission and preferred email for response.

16.2. The request must be filed personally by the data subject. The Controller undertakes to perform identity verification before processing the request.

16.3. If the Controller cannot identify the individual based on existing data, the Controller reserves the right to request a copy of a personal ID document (passport, identity card, driver’s license or other official documents containing identifying data).

16.4. The Controller considers each request and provides the individual with information on actions taken regarding the submitted request within two months following submission. If needed — the period may be extended by one additional month, taking into account complexity and request volume. The data subject will then be informed on the delay justification.

16.5. If the Controller does not take any action regarding a submitted request — the Controller is obligated to notify the data subject no later than one month following submission, stating reasoning for lack of action and providing information on available legal protection and complaint options.

16.6. The Controller is obligated to notify each Recipient to whom personal data were disclosed regarding each correction, deletion or processing restriction, unless such action is impossible or requires disproportionately large effort. Upon request — the Controller will disclose information on those Recipients to the data subject.

17. RIGHT TO OBJECT

17.1. Individuals have the right to object at any time, on grounds relating to their specific situation, against Controller processing involving legitimate interests, public interests, or official powers. The Controller must stop the processing, unless the Controller provides convincing lawful grounds taking precedence over data subject rights, or the processing is required for the establishment or defense of legal claims. For profiling-related objections — the same procedure applies.

17.2. For direct marketing purposes — individuals have the right to object at any time to Controller processing involving direct marketing or profiling related to direct marketing. In such cases — the processing must stop immediately.

17.3. Objections must be lodged via a written request by mail at the address stated in this Policy or via email, including clear indication of refusal of marketing correspondence for direct marketing objections.

18. LINKS, TOOLS AND CONTENT FROM OTHER COMPANIES

18.1. The Website contains buttons or embedded tools from third-party companies such as: Facebook, YouTube and Instagram. All external Websites are independent, and the Controller bears no responsibility for any damages or losses resulting from the use of third-party Websites. The use of such Websites is at the user’s own responsibility. It is recommended that individuals consult the relevant third-party privacy policy for more information.

19. CHANGES TO THE PRIVACY POLICY

19.1. This Privacy Policy may be updated at any time in the future. The updated version will be posted on the Website with a new “Last updated” date at the top of this page and will become effective from the date of its posting. Continued use of the Website after updates shall be deemed as acknowledgment and acceptance of the posted changes. It is recommended that users consult and review the Privacy Policy periodically to stay informed on recent changes.

20. CONTACT DETAILS

20.1. If you have additional questions regarding this Privacy Policy, do not hesitate to contact us at +359 887 750 088 or info@violetaorientaldance.com.