The provision of online services and products within the online platform InvoiceOut requires the processing of personal data. This document provides information on the compliance measures taken by the Provider in accordance with the principles of lawful, transparent and conscientious processing of personal data, pursuant to the General Regulation on Data Protection, effective from 25 May 2018 on the territory of all countries of the European Union.

At any time, the User may exercise his right to object to the processing of personal data relating to him / her by contacting the Provider in the above ways.

The provider of online services and / or products provided within the InvoiceOut platform performs processing of personal data in compliance with the following principles:

2.1. Legality, transparency and conscientiousness:

With its policy of transparency regarding the processed personal data, the Provider aims to establish lasting relationships with users of the online platform InvoiceOut, based on trust and guaranteed by the possibility of active participation and control by users in the implementation of personal data processing activities. The principle of lawful, transparent and conscientious processing puts data subjects at the center.

2.2. Goal Limitation:

The processing of personal data relating to the User is carried out only on the grounds provided for in the General Data Protection Regulation. This data is not further processed in a way incompatible with these purposes. Defining the goal is a key first step in implementing legal measures to protect personal data and developing guarantees for their protection in any processing activity. The purpose limitation principle aims to establish the limits within which personal data collected for a given purpose can be processed and used for further use.

“InvoiceOut” does not collect personal data for purposes other than those for which the User was initially notified and provided voluntarily.

2.3. Minimize data:

In the activity of "InvoiceOut" are processed only personal data that are necessary for the individualization of the User, related to and limited to what is necessary in connection with the provision of the service requested by the User. The activities and processes are organized around the minimum of personal data that is necessary to achieve the respective goals.

2.4. Accuracy:

The personal data that the Provider processes are accurate, correct and up-to-date. According to the General Terms of Use of the “InvoiceOut” platform, the User is responsible for the accuracy and timeliness of personal data provided by him. The online platform allows timely updating of data, incl. deleting or deleting inaccurate or outdated data.

2.5. Storage restriction:

The provider shall store personal data in a form that allows the identification of the data subject for a period not longer than necessary for the purposes for which the personal data are processed. In cases where the exact period is known in advance, it is explicitly stated.

2.6. Security of processing:

The provider processes personal data in a way that ensures an appropriate level of security. Personal data relating to the User are protected against unauthorized or illegal processing and against accidental loss, destruction or damage. In order to comply with this principle, the Provider applies appropriate technical and organizational measures in accordance with legal requirements.

2.7. Reporting:

The processing of personal data is based on the trust between the User, as a data subject, and the Provider, as a controller of personal data. For this reason, the Provider maintains up-to-date information on measures and means of compliance, including the Data Protection Policy, risk assessment, technical, organizational measures, etc.

3.1. According to Section IV of the General Terms and Conditions of the online platform "InvoiceOut", the Provider processes personal data in order to provide the User with quality, adequate and professional service. Processing is any activity involving personal data, including the initial collection, processing, modification, deletion and obliteration. Any processing of personal data is carried out solely for specific purposes and only on one of the legal bases listed in the General Data Protection Regulation.

3.2. Personal data processed in connection with the operation of the website invoiceout-bg.org:

In order to provide the services and improve their quality, the Provider automatically stores certain information that the computer or other end device of the User sends to the server of the provider of storage of foreign information (eg.: hosting company) in connection with the activity of the User. The information is stored in log files on servers of a third-party information storage service provider and may include data on:

• Web pages visited by the User from the website invoiceout-bg.org ; websites that have redirected the User to the website invoiceout-bg.org ; and websites visited by the User through electronic links posted on the website invoiceout-bg.org ;
• date and time of the visits under the item above;
• public IP address of the user's end device;
• type, name and version of the browser used by the Internet;
• keywords used to search for information on the website invoiceout-bg.org ;
• number of users who visited a particular web page from the website invoiceout-bg.org ;
• number of clicks on electronic links from the website invoiceout-bg.org , etc.

Collection, processing and use of log files containing, for example: date, time, source of the connection - IP addresses, where required by applicable law, as well as log files and any other information necessary to reproduce electronic statements made by visitors to the website in the course of using the services or to identify the user (where applicable) in the event of a legal dispute.

3.3. In applicable cases, when providing the services, the Provider stores information and gets access to information stored on the user's end device, which it processes for the following purposes:

• ensuring the normal and quality access of the user to the services with all their functional capabilities;
• checking for the presence of scripts, software applications and settings of the user's end device, necessary for the normal access and use of the services and, accordingly, informing about the lack of such;
• tracking and preventing multiple registrations by the same user and committing illegal acts;
• visualize or hide elements from the website invoiceout-bg.org that have specific requirements, compatible or incompatible with specific properties, qualities or settings of the user's end device, such as. screen width, resolution, etc .;
• adapting the services and providing automatic display or hiding of various elements of the website invoiceout-bg.org according to the preferences and settings of the user;

3.4. These data are collected and processed on the basis of art. 6, para. 1, p. (f) of the General Data Protection Regulation.

4.1. The processing of personal data is associated with the occurrence of certain consequences for the User, on the basis of which the Provider takes the necessary technical and organizational measures to protect data from accidental or illegal destruction, accidental loss, unauthorized access, alteration or dissemination, and others illegal forms of processing, including but not limited to:

• technical and organizational measures taken by a service provider for the storage of foreign information;
• encrypt the connection between the user's end device and the service provider's website using an SSL certificate.

4.2. All measures taken are in line with modern technological developments and provide a level of protection commensurate with the risks associated with the processing and the nature of the data to be protected.

4.3. In all registration and other forms that require identification of the user, the mandatory or voluntary nature of the provision of data, as well as the consequences of refusal to provide it, shall be clearly indicated. In order to avoid any doubts, in the relevant registration forms the provision of data marked as mandatory is a prerequisite for successful registration and any failure to provide them is an obstacle to access to services that require registration.

5.1. Right of access:

The user has the right to receive confirmation of the processing of personal data related to him/her and, if so, to access the data and the following information:

• Copy of personal data that are being processed;
• The purposes of processing;
• The categories of personal data processed;
• Recipients or categories of recipients to whom personal data are or will be disclosed;
• The envisaged period for which the personal data will be stored or at least the criteria used to determine this period;
• Any available information about the source of personal data that is not collected directly from the User, if any.

The user has the right to apply his/her right of access using the contact form available from the "Contacts" section of the front page of the website invoiceout-bg.org , through an online message to the contact email or through a message within the InvoiceOut platform.

The user should specify:

• The specific data of which information is required;
• Name and contact details;

IMPORTANT : The provider may refuse the request for access if the data contains information about a third party, except in cases where the third party has consented to the disclosure of this information.

The information in this section shall be provided by the Provider within one month in accordance with Article 12 (3) of the General Data Protection Regulation.

5.2. Right of adjustment

Adjustments to user profile data, e.g. names, password, etc. can be performed manually by the User in accordance with the terms and conditions specified in the General Terms of Use of the online platform "InvoiceOut".

5.3. Right of deletion

The user has the right to submit a request for deletion of personal data related to him / her. The Provider undertakes to respond to any such request and to delete / obliterate personal data without undue delay in cases where:

• Personal data are no longer needed for the purposes for which they were collected or otherwise processed;
• The user has withdrawn his consent to the processing of data that are processed on the basis of consent or explicit consent;
• The user has objected to the processing of personal data and there are no legal grounds for processing to take precedence;
• The user has objected to the processing of personal data for the purposes of direct marketing, which includes the following cases: sending product information (for registered users who have requested the service), sending a newsletter (for users who have requested the service);
• The User has considerations that there is a legal obligation of the Provider to delete certain personal data, which derives from the law of the European Union or the law of the Republic of Bulgaria.

The user can apply this right by using the contact form available from the "Contacts" section of the front page of the website invoiceout-bg.org , via an online message to the contact email or via a message within the InvoiceOut platform., indicating which categories of personal data he wishes to be deleted and the reason why he considers that there is reason to delete the information, as well as his name and contact details.

The provider has the right to refuse the deletion of personal data on one of the grounds provided for in Article 17 (3) of the General Data Protection Regulation, namely:

• If the data are needed in connection with: freedom of expression and information; legal obligation to preserve; public health; establishing, exercising or defending legal claims; where the deletion of the data will harm scientific or historical research or archiving that is in the public interest;
• If the request is justified, the Provider will delete / delete the relevant data within one month, in accordance with Article 12 (3) of the General Data Protection Regulation.

5.4. Right of processing restriction

At any time, the User has the right to request a restriction on the processing of personal data relating to him / her. This right may be applied on one or more of the following grounds:

• The user has reasonable considerations or it has been established beyond doubt that the processing of personal data is unlawful, but nevertheless prefers not to delete the data, but only to limit their processing;
• The user has exercised his right to object to the competent authorities and is awaiting the outcome of an examination of the data controller's legitimate grounds and their advantage over the data subject's interests.

In order to limit the use of personal data, the User may take some of the following measures:

• temporary transfer of data to another system;
• temporarily remove your data from the website invoiceout-bg.org .

The Provider has the right to refuse to apply this right in case the User's claim is "manifestly unfounded or excessive", which means that the amount of resources for the Provider is disproportionately large compared to the potential risks for the User.

The user can apply this right by using the contact form available from the "Contacts" section of the title page of the website invoiceout-bg.org , via an online message to the contact email or via a message within the InvoiceOut platform, indicating the processing to which personal data he wishes to be limited, as well as his name and contact details.

If the User's request is justified, the Provider will limit the processing of data within one month, in accordance with Article 12 (3) of the General Data Protection Regulation. In some cases, additional research time may be required for up to two months - in these cases, the Provider notifies the User of the delay compared to the initial one-month period.

In all cases and regardless of the availability of other means of protection, the User has the right to refer to the competent supervisory authority in the person of the Commission for Personal Data Protection.

Contact details of the Commission for Personal Data Protection:

Address: Sofia, POI 1592, Prof. Tsvetan Lazarov ”№ 2
Phone: +359 (2) 91 53 518
E-mail address: [email protected]

With this Policy, the Provider in the person of "Magnic Software" Ltd. expresses its readiness for cooperation and dialogue before proceeding a claim to the supervisory authority.

In order to promote the activities of the online platform “InvoiceOut”, the Provider uses social media and platforms.

On the website invoiceout-bg.org electronic links are placed to the relevant profiles in these social media and platforms, but these links do not place their cookies on the end devices of the User when loading the pages via a link from the website.

Each social media / platform has its own Policy regarding the way they process the personal data of the User, which requires the person concerned to familiarize themselves with the specific privacy policies before using them.