Privacy policy
This English translation is provided for convenience. See also the Bulgarian version.
General information
ВИ АР МАКС ЕООД operates in accordance with the Bulgarian Personal Data Protection Act and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR), in force since 25 May 2018. The Regulation aims to protect the data of individuals in all EU member states and to harmonise the rules on its processing.
As a controller and processor of personal data in providing information and advertising services, VR MAX meets all requirements of this regulation: it collects personal data only to the extent necessary to provide the service and keeps it responsibly and lawfully.
Controller
ВИ АР МАКС ЕООД
Company ID (EIK/BULSTAT): 204348967
Registered office: bl. 111, entr. B, apt. 71, Hadzhi Dimitar, Sofia, Bulgaria
Email: [email protected]
Processors and recipients
To run the website the controller uses the following providers, who process data on its behalf:
- Cloudflare, Inc. (USA): website hosting, protection against attacks and forwarding anonymous visits to Google Analytics. cloudflare.com/privacypolicy
- Google Ireland Limited (Ireland) and Google LLC (USA): Google Analytics and Google Ads measurement, only with your cookie consent. policies.google.com/privacy
- Web3Forms: delivers messages from the enquiry form to the controller's email. web3forms.com/privacy
- Wistia, Inc. (USA): the videos on the service pages. wistia.com/privacy
Supervisory authority
Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592. Phone: 02 915 3 518. Email: [email protected], [email protected]. Website: www.cpdp.bg
Basis for collecting, processing and storing your personal data
Art. 1. (1) VR MAX collects and processes your personal data in connection with the provision of information and advertising services. (2) VR MAX is the controller and processor of your data as a user of our services.
Purposes and principles
Art. 2. (1) VR MAX collects and processes the personal data you provide when using our information and advertising services, including for the following purposes:
- sending an enquiry through the built-in contact form to a member of VR MAX staff;
- preparing a quote and replying to your enquiry;
- anonymous visit statistics and, only with your consent, cookie-based statistics and ad measurement, to improve the website.
(2) VR MAX follows these principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality, with an appropriate level of security.
(3) VR MAX may process and store personal data to protect its legitimate interests, namely to fulfil its obligations to the National Revenue Agency, the Ministry of Interior and other state and municipal authorities.
What personal data we process
Art. 3. (1) A. Identification data (first and last name, email, phone) — to contact you and send you information, including at your request. Legal basis for enquiries: taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR). B. Visit data: if you have not accepted cookies, only anonymous data (page viewed, country, device type, language and the keyword of our ad) is sent to Google Analytics, without cookies, IP address or identifier. VR MAX does not store this data. Legal basis: legitimate interest (Art. 6(1)(f)). C. Statistics and advertising cookies (Google Analytics and Google Ads): only if you accept them in the banner. Legal basis: consent (Art. 6(1)(a)), which you can withdraw at any time via "Cookie settings" at the bottom of the site. Details: Cookie policy. D. Technical data: the hosting provider (Cloudflare) processes your IP address temporarily to deliver the page and protect the site against attacks. VR MAX does not store IP addresses.
(2) VR MAX does not collect or process data revealing racial or ethnic origin, political, religious or philosophical beliefs or trade union membership, nor genetic or biometric data, data concerning health, sex life or sexual orientation.
(3) Personal data is collected directly from the individuals concerned. (4) The company does not carry out automated decision-making.
Retention period
Art. 4. VR MAX keeps personal data submitted through the contact form for 30 calendar days. After this period, VR MAX takes the necessary steps to delete and destroy all your data without undue delay.
Withdrawing consent
Art. 5. (1) If you do not want some or all of your personal data to continue to be processed for a specific purpose or for all purposes, you can tell us at any time with a free-text request to [email protected]. (2) VR MAX may ask you to verify your identity as the data subject.
Right of access
Art. 6. You have the right to obtain confirmation of whether personal data concerning you is being processed, and access to that data and to information about its collection, processing and storage. On request, VR MAX will provide a copy in electronic or another suitable form. Access is free of charge, but VR MAX reserves the right to charge an administrative fee for repeated or excessive requests.
Right to erasure (“right to be forgotten”)
Art. 7. (1) You may request erasure of your personal data, and VR MAX must erase it without undue delay where: the data is no longer necessary for the purposes for which it was collected; you withdraw your consent and there is no other legal basis; you object to the processing, including for direct marketing, and there are no overriding legitimate grounds; the data was processed unlawfully; erasure is required by EU or member-state law; or the data was collected in connection with information society services.
(2) VR MAX is not obliged to erase data processed: for exercising freedom of expression and information; to comply with a legal obligation or perform a task in the public interest or in the exercise of official authority; for public health reasons; for archiving in the public interest, scientific or historical research or statistics; or for establishing, exercising or defending legal claims.
(3) To exercise this right, send a request by email to [email protected] or in writing to VR MAX, and verify your identity in person with your identity card. (4) VR MAX does not erase data it is legally obliged to keep, including to defend itself against legal claims or to prove its rights.
Right to restriction
Art. 8. You may ask VR MAX to restrict processing where: you contest the accuracy of the data, for the period needed to verify it; the processing is unlawful but you do not want the data erased; VR MAX no longer needs the data but you require it for legal claims; or you have objected to processing, pending verification of whether VR MAX’s legitimate grounds override yours.
Right to data portability
Art. 9. You may at any time obtain the data stored and processed about you by emailing [email protected], and ask VR MAX to transfer it directly to another controller where technically feasible.
Right to information
Art. 10. You may ask VR MAX to tell you about all recipients to whom data subject to a rectification, erasure or restriction request has been disclosed. VR MAX may refuse if this is impossible or would involve disproportionate effort.
Right to object
Art. 11. You may object at any time to the processing of your personal data by VR MAX, including for profiling or direct marketing.
Personal data breaches
Art. 12. (1) If VR MAX detects a breach likely to result in a high risk to your rights and freedoms, we will notify you without undue delay of the breach and of the measures taken or planned. (2) VR MAX is not obliged to notify you if it has applied appropriate technical and organisational protection to the affected data; has subsequently taken measures ensuring the high risk is no longer likely; or notification would involve disproportionate effort.
Recipients of your personal data
Art. 13. VR MAX does not sell or share your personal data with third parties, except with the processors listed above and with public authorities where required by law. Art. 14. Some processors (Cloudflare, Google, Wistia) may process data in the USA. Such transfers rely on the EU-U.S. Data Privacy Framework and/or standard contractual clauses approved by the European Commission.
Other provisions
Art. 15. If your rights under this policy or applicable data protection law are infringed, you may lodge a complaint with the Commission for Personal Data Protection (details above).
Art. 18. You may exercise all your data protection rights using the forms attached to this information. These forms are not mandatory: you may submit your request in any form that contains a statement to that effect and identifies you as the data subject.