Cookie Policy
COOKIE POLICY AND SIMILAR TECHNOLOGIES
1. Purpose and scope
1.1.
This Cookie Policy explains how LEAN BULGARIA OOD uses cookies and other similar technologies in connection with Lean Champions Platform, Lean Champions Store and the website leanchampionscommunity.com.
1.2.
The policy shall apply to:
1) visiting the public pages of the Platform;
2) creating and using a user profile;
3) signing in to an individual or corporate account;
4) use of the basket;
5) placing an order;
6) choice of payment method;
7) choice of delivery method;
8) use of paid digital content;
9) using a digital service or subscription;
10) use of the training environment;
11) use of 5S, audit, reporting and other modules;
12) viewing an embedded video, map, external form or other content;
13) granting or refusing consent for optional technologies;
14) using another function that stores information on the terminal device or accesses information already stored there.
1.3.
This policy applies not only to traditional cookies but also to other technologies that can store information on, or read information from, a computer, phone, tablet or other terminal device.
1.4.
This policy shall apply together with:
1) The Privacy Policy;
2) the Terms and Conditions;
3) Delivery and payment policy;
4) the information in the “Cookie settings” panel;
5) the additional information displayed prior to activation of a specific external service;
6) the applicable legislation.
1.5.
The consent for optional cookies is separate from:
1) acceptance of the Terms and Conditions;
2) placing an order;
3) consent to electronic marketing communications;
4) consent to the immediate provision of digital content;
5) the request for early start of a digital service;
6) other contractual or legal statements.
1.6.
Continuing to browse the site, scrolling, closing the banner, taking no action or using the main functions does not constitute consent to optional cookies.
1.7.
Rejecting optional cookies does not restrict the visitor’s mandatory rights or prevent use of the Platform’s main content and strictly necessary functions.
2. SUPPLIER DETAILS
2.1.
The supplier of Lean Champions Platform and controller of personal data processed for its own purposes described in this policy is:
LEAN BULGARIA OOD
Unified Identification Code (UIC): 203317933
VAT identification number: BG203317933
Registered office and management address: Sofia, 55 Kiril Popov Street, entrance A, floor 1, apartment 4, Republic of Bulgaria
Manager: Todor Neychev
Email: admin@leanchampionscommunity.com
Telephone: +359 896 060 911
Website: leanchampionscommunity.com
hereinafter referred to as the “Merchant”, “Supplier”, “Controller”, “we”, “us” or “our”.
3. WHAT COOKIES ARE
3.1.
Cookies are small files or pieces of information that a website can store in a visitor’s browser or terminal device.
3.2.
On a subsequent visit, the browser may return the relevant information to the website or to the supplier that placed the technology.
3.3.
Cookies can allow the Platform to:
1) maintain an active user session;
2) recognise that the user is signed in to their account;
3) remember the contents of the basket;
4) protect forms and payments;
5) remember selected settings;
6) record cookie preferences;
7) identify technical problems;
8) measure page usage;
9) provide external content;
10) measure the effectiveness of an advertising campaign;
11) perform another function explained in advance.
3.4.
A cookie may contain a unique identifier but does not normally directly contain a name, address or full payment-card number.
3.5.
Information collected through cookies may constitute personal data where it allows the direct or indirect identification or differentiation of a natural person.
3.6.
The requirements for storing information on, or reading information from, a terminal device may also apply where the information itself is not personal data.
4. Similar technologies
4.1.
In addition to cookies, the Platform may use similar technologies, including:
1) local storage in the browser;
2) session storage;
3) pixels;
4) tags;
5) scripts;
6) software development kits;
7) device identifiers;
8) technologies for measuring openings and interactions;
9) security tokens;
10) fraud prevention technologies;
11) other technical means of storing information on, or accessing information from, the terminal device.
4.2.
The rules of this policy apply to these technologies according to their purpose, operation and legal basis.
4.3.
When a new technology is introduced, its purpose, supplier, duration and category are added to the register of technologies used before it is activated for visitors.
5. FIRST-PARTY AND THIRD-PARTY COOKIES
5.1.
A first-party cookie is a cookie placed or managed by the Lean Champions Platform domain.
5.2.
A third-party cookie is a cookie placed or managed by an external supplier through an integrated service, external resource, embedded content or redirect.
5.3.
External suppliers may include:
1) payment operators;
2) courier and logistics providers;
3) video content platforms;
4) mapping services;
5) videoconferencing services;
6) training platforms;
7) analytics services;
8) advertising platforms;
9) cybersecurity providers;
10) other technical suppliers.
5.4.
Listing a category in this policy does not mean that every possible external service is actually active.
5.5.
The current suppliers and technologies are listed in the register accessible through “Cookie settings”.
6. Session and persistent cookies
6.1.
Session cookies normally remain active only while the browser is open and are deleted when the session ends, unless their technical characteristics provide otherwise.
6.2.
Persistent cookies remain on the device for a predetermined period or until the user deletes them.
6.3.
The duration of each persistent cookie is determined according to:
1) its purpose;
2) necessity;
3) the risk to privacy;
4) security requirements;
5) the duration set by the relevant supplier;
6) the applicable legislation.
6.4.
The specific duration of each active technology shall be indicated in the cookie register.
7. Rules on storage and access to information
7.1.
Information is stored on, or accessed from, the terminal device:
1) after providing clear and comprehensive information;
2) after providing a real choice;
3) after valid prior consent where the technology is not strictly necessary;
4) without consent only where the legal exception for strictly necessary technology is applicable.
7.2.
A technology is strictly necessary where its use is objectively necessary:
1) solely to transmit a communication over an electronic communications network;
2) to provide an information society service explicitly requested by the user.
7.3.
The Supplier’s convenience, a general desire for statistics, advertising or an improved user experience do not, by themselves, make a technology strictly necessary.
7.4.
In the case of optional technology, the consent shall be:
1) freely given;
2) specific;
3) informed;
4) unambiguous;
5) given by clear affirmative action;
6) demonstrable;
7) capable of being withdrawn at any time.
7.5.
The consent shall not be derived from:
1) silence;
2) inaction;
3) a pre-ticked checkbox;
4) continuing to browse;
5) scrolling;
6) closing the window;
7) pressing a button for another primary purpose;
8) general acceptance of the Terms and Conditions.
8. Technology categories
8.1.
According to their purpose, technologies may be divided into:
1) strictly necessary;
2) functionality and preferences;
3) analytics and performance;
4) marketing and advertising;
5) external content and social functions;
6) other clearly described categories.
8.2.
All categories other than strictly necessary technologies are disabled by default until the visitor makes a valid choice.
8.3.
Where a technology has more than one purpose, it is classified according to all of its actual purposes, and consent is determined by the purpose requiring the higher level of protection.
8.4.
Technology is not marked as strictly necessary only to avoid the requirement of consent.
9. Strictly necessary cookies
9.1.
The strictly necessary technologies provide basic features explicitly requested by the visitor.
9.2.
They may be used for:
1) creating and maintaining a protected session;
2) signing in to a user account;
3) authentication of identity;
4) protection against forged requests;
5) protection of forms;
6) preventing unauthorised access;
7) management of the basket;
8) remembering selected products during the ordering process;
9) remembering the selected delivery method during the order;
10) maintaining the technical connection;
11) load balancing;
12) remembering cookie preferences;
13) prevention of fraud;
14) enabling a payment explicitly initiated by the Customer;
15) another function without which the explicitly requested service cannot be technically provided.
9.3.
Strictly necessary technologies are not used for:
1) profiling for advertising;
2) tracking between unrelated websites;
3) measuring advertising campaigns;
4) creation of marketing audiences;
5) general analytics that are not necessary to provide the explicitly requested service.
9.4.
Consent is not requested for strictly necessary technologies, but information about them is provided.
9.5.
The user may block some of these technologies through their browser, but this may make it impossible to:
1) sign in to an account;
2) retain a basket;
3) making an order;
4) protection of a form;
5) using another basic functionality.
10. Security and authentication cookies
10.1.
Security technologies may be used for:
1) recognition of a valid session;
2) detecting failed sign-in attempts;
3) limiting automated attacks;
4) prevention of fraud;
5) protection of administrative functions;
6) protection of payments;
7) detection of abnormal behaviour;
8) maintaining the integrity of requests;
9) another necessary protective function.
10.2.
Where protective technology is objectively necessary for the secure provision of the explicitly requested service, it may be classified as strictly necessary.
10.3.
A security technology is not used for unrelated marketing or profiling without a separate applicable legal basis and consent.
11. Basket and ordering process
11.1.
The platform may use strictly necessary technologies for:
1) adding a product to the basket;
2) keeping the selected quantity;
3) calculating the final price;
4) connecting individual steps of the order;
5) maintaining the chosen method of payment;
6) maintaining the chosen delivery method;
7) preventing duplicate submission;
8) preventing loss of the order when moving between pages.
11.2.
Technology necessary only to preserve the basket for an extended marketing period after leaving the site is not automatically considered strictly necessary.
11.3.
An abandoned basket is used for marketing only where there is an applicable legal basis and the relevant information has been provided.
12. Payments and myPOS
12.1.
When the Customer selects card payment and starts the payment process, they may be redirected to the secure myPOS environment.
12.2.
myPOS may use its own strictly necessary technologies for:
1) secure processing of payment;
2) authentication of the transaction;
3) prevention of fraud;
4) maintaining the payment session;
5) fulfilling regulatory requirements.
12.3.
These technologies can be activated when the Customer explicitly selects a card payment and starts the payment process.
12.4.
myPOS may act as an independent controller for its own processing and provides separate information about its technologies and processing of personal data.
12.5.
Lean Champions Platform does not use the information from the payment environment for marketing tracking without a separate applicable basis.
12.6.
A payment component which includes optional analytical or advertising technologies should not activate these technologies without the necessary consent.
13. Delivery and courier functions
13.1.
When the Customer uses an integrated function to select an Econt or other courier office, address or service, technologies necessary to perform the explicitly requested action may be used.
13.2.
Such technologies may be used for:
1) loading a list of offices;
2) selecting a town or other locality;
3) calculating delivery costs;
4) keeping the selected office within the order;
5) technical interaction with the courier service.
13.3.
Where the integration includes the courier’s optional analytics or marketing technologies, these are activated only with the applicable consent.
13.4.
The courier may process personal data and use technologies as an independent controller in providing its service.
14. Functional cookies and preferences
14.1.
Functional technologies allow the Platform to remember choices and settings that are not strictly necessary for the main service.
14.2.
They can be used for:
1) preferred language;
2) selected view;
3) text or interface size;
4) last-used section;
5) Video preferences;
6) dashboard settings;
7) convenience features for return visits;
8) other personalised settings.
14.3.
Functional technologies shall be activated after consent, unless the specific technology is strictly necessary for a function explicitly requested by the user.
14.4.
If functional technologies are rejected, the Platform remains accessible, but some settings may not be remembered between visits.
15. ANALYTICS COOKIES AND PERFORMANCE TECHNOLOGIES
15.1.
Analytical technologies may be used to obtain statistical information on:
1) number of visits;
2) pages used;
3) loading time;
4) technical errors;
5) the browsing sequence;
6) the type of device used;
7) the overall interface efficiency;
8) interaction with certain functions;
9) the source of the visit;
10) other indicators for the use of the Platform.
15.2.
Information may be used for:
1) improving navigation;
2) detection of technical difficulties;
3) Evaluation of the use of functionalities;
4) development planning;
5) the creation of statistical reports.
15.3.
Analytical technologies that are not strictly necessary to provide the explicitly requested service shall be activated only after prior consent.
15.4.
Using analytics information in aggregated or pseudonymised form does not automatically remove the requirement for consent to the initial storage of information on, or reading of information from, the device.
15.5.
Where technically possible, the analytical settings shall be configured to:
1) collect a minimum amount of data;
2) limit the retention period;
3) limit sharing;
4) exclude advertising functions;
5) truncate or pseudonymise identifiers;
6) do not create profiles for unrelated purposes.
15.6.
If analytics technologies are rejected, the Platform’s main functions continue to work.
16. Marketing and advertising technologies
16.1.
Marketing technologies can be used for:
1) measuring an advertising campaign;
2) identifying whether a visitor reached the Platform through an advertisement;
3) limiting the frequency of display of advertising;
4) the creation of audiences;
5) personalising advertising content;
6) reaching visitors again through an external platform;
7) connecting interactions between different websites or applications;
8) other advertising purposes.
16.2.
Marketing technologies are not strictly necessary for the use of the Platform.
16.3.
They shall only be activated after prior, specific and informed consent.
16.4.
The refusal of marketing technology does not necessarily mean that the visitor will not see advertising, but that advertising should not be personalised through the refused technologies.
16.5.
Consent to marketing cookies does not automatically constitute consent to receive electronic marketing communications.
16.6.
Consent to an email newsletter does not automatically constitute consent to marketing cookies.
17. External video, maps and other embedded content
17.1.
The platform may contain embedded elements from external suppliers, including:
1) videos;
2) maps;
3) presentations;
4) audio materials;
5) forms;
6) training resources;
7) social media posts;
8) other external components.
17.2.
The external supplier may place their cookies or obtain technical information including IP address, device, browser and interaction with the content.
17.3.
An external component that is not strictly necessary is not loaded before the necessary consent is obtained.
17.4.
Instead of loading it automatically, the following may be displayed:
1) a static placeholder;
2) a privacy notice;
3) a “Load content” button;
4) possibility to activate the relevant category.
17.5.
When a visitor explicitly chooses to load specific external content, they receive information about the supplier and the technologies that may be used.
17.6.
Where reasonably possible, an alternative means of accessing basic information without activation of external marketing technologies shall be provided.
18. Social networks and sharing buttons
18.1.
An ordinary link to a social network must not, by itself, activate tracking technology before the visitor clicks the link.
18.2.
An embedded social-network button, post or component may transmit information to the relevant platform.
18.3.
Where such a component uses optional technologies, it is loaded only after consent or an explicit action taken after appropriate information has been provided.
18.4.
After visiting the social network, its operator processes data according to its own terms and policies.
19. Cookie banner
19.1.
Upon first visit or where a renewal of the selection is required, a cookie management window shall be displayed.
19.2.
The first layer of the window shall provide clear information on:
1) the use of cookies and similar technologies;
2) the main objectives;
3) the existence of optional categories;
4) the right to refuse optional technologies;
5) the right to change or withdraw the choice at any time;
6) a link to this policy.
19.3.
The first layer provides clearly visible options to:
1) “Accept all”;
2) “Reject optional cookies”;
3) open “Cookie settings”.
19.4.
The option to reject is not hidden in lengthy text, outside the window or behind a visually inconspicuous link.
19.5.
Buttons and text are not designed misleadingly to steer the visitor unjustifiably towards acceptance.
19.6.
The following are not used:
1) pre-ticked categories;
2) misleading colours;
3) vague double negatives;
4) an incorrectly labelled close button;
5) a claim that cookies are mandatory when they are not;
6) repeated pressure to accept after a valid rejection;
7) another manipulative structure.
19.7.
The Platform’s main content is not made inaccessible merely because a visitor rejects optional technologies.
19.8.
A specific external function may remain unavailable where technically it cannot be provided without a chosen technology, but this is clearly explained and, where reasonably possible, an alternative is provided.
20. “Cookie settings” panel
20.1.
The panel allows the visitor to:
1) see the different categories;
2) obtain information about the purposes;
3) enable or disable each optional category;
4) accept all;
5) reject all optional technologies;
6) save a customised choice;
7) withdraw previous consent;
8) open the current register of technologies.
20.2.
Strictly necessary technologies may be labelled as always active.
20.3.
For each optional category the switch is switched off by default.
20.4.
Categories are not grouped in a way that forces the visitor to accept unrelated purposes simultaneously.
20.5.
Where individual suppliers process data for materially different purposes, the information shall be provided with sufficient detail.
21. Giving consent
21.1.
The visitor gives consent by:
1) clicking “Accept all”;
2) enabling selected categories and clicking “Save preferences”;
3) another clear affirmative action, which is specifically related to the chosen technology.
21.2.
Before consent, optional technologies remain blocked.
21.3.
The consent shall only concern:
1) the selected categories;
2) the objectives described;
3) those suppliers;
4) the current version of the settings.
21.4.
Consent is not used for a materially different new purpose without new information and, where necessary, a new choice.
21.5.
If a new supplier or purpose is added that is not covered by the previous choice, the relevant technology is not activated on the basis of the previous consent.
22. Refusal of optional cookies
22.1.
The visitor can reject all optional technologies using the “Reject optional cookies” button.
22.2.
If optional technologies are rejected:
1) the strictly necessary technologies remain active;
2) analytical technologies are not activated;
3) marketing technologies are not activated;
4) optional functional technologies are not activated;
5) optional external content may remain blocked.
22.3.
Rejection does not result in:
1) additional price;
2) refusal of service;
3) loss of a legal right;
4) automatic termination of the profile;
5) inability to browse the main public information.
22.4.
If the visitor makes no choice, optional technologies remain disabled.
23. Withdrawal and modification of consent
23.1.
The consent may be withdrawn at any time.
23.2.
Withdrawing consent must be as easy as giving it.
23.3.
A permanently accessible “Cookie settings” link is provided at the bottom of the pages or in another easy-to-find location.
23.4.
Using this link, the visitor can:
1) view their current choice;
2) disable individual categories;
3) to refuse all optional technologies;
4) to make a new choice.
23.5.
Withdrawal takes effect for future use of the relevant technologies.
23.6.
Withdrawal does not affect the lawfulness of processing carried out before it.
23.7.
Where technically possible, after withdrawal, the Platform removes its optional cookies.
23.8.
Some previously stored third party technologies may need to be deleted by:
1) browser settings;
2) the relevant supplier’s tool;
3) another technical option provided.
23.9.
Changing the settings must not require more steps than the initial acceptance.
24. Duration of the choice and renewed requests
24.1.
The choice concerning cookies shall be remembered for the period specified in the consent technology register.
24.2.
The choice is not treated as having an indefinite duration.
24.3.
A new choice may be requested when:
1) expiry of the reasonable period of the previous choice;
2) a substantial change of objectives;
3) adding a new category;
4) adding a new supplier with a substantially different activity;
5) change of legal requirements;
6) losing or erasing the selection information;
7) there are reasonable doubts about the validity of the previous consent.
24.4.
The window is not shown unduly often after a valid rejection solely to pressure the visitor to change their decision.
24.5.
If the visitor deletes the cookie that stores their choice, the Platform may not recognise the previous setting and may display the window again.
25. Recording and demonstrating the choice
25.1.
To prove and manage the choice we can store:
1) random consent identifier;
2) date and time;
3) selected categories;
4) rejected categories;
5) version of the window;
6) version of the Cookies Policy;
7) language;
8) domain;
9) technical source of choice;
10) Limited technical information necessary to demonstrate the choice.
25.2.
No more information shall be collected than reasonably necessary to demonstrate and apply the choice.
25.3.
The consent record may also be stored after its withdrawal where necessary for:
1) proof of legality;
2) giving effect to the objection;
3) preventing reactivation;
4) protection of legal claims.
25.4.
The detailed time limits shall be determined in accordance with the Privacy Policy.
26. Browser management
26.1.
Most browsers allow:
1) review of stored cookies;
2) deleting individual cookies or all cookies;
3) blocking first-party cookies;
4) blocking third-party cookies;
5) deleting cookies on closing the browser;
6) limiting local storage;
7) managing site permissions.
26.2.
The control mode depends on the browser and device used.
26.3.
Blocking all cookies can lead to:
1) inability to sign in;
2) losing the basket;
3) Inability to send a protected form;
4) inability to save cookie preferences;
5) incorrect operation of other basic functions.
26.4.
Deleting cookies through the browser does not replace withdrawing consent where the visitor wants the Platform to remember their rejection.
26.5.
We recommend first changing the choice through “Cookie settings” and then, if necessary, deleting the existing files through the browser.
27. Register of used cookies and technologies
27.1.
The current register is provided via the panel "Cookie settings" or by a separate easily accessible section of this page.
27.2.
For each active technology, the register shall contain, where applicable:
1) name;
2) supplier;
3) domain;
4) category;
5) objective;
6) a description of the information processed;
7) whether it is first-party or third-party;
8) whether it is session-based or persistent;
9) period of validity;
10) activation moment;
11) a legal basis;
12) third party access information;
13) information about transfers outside the European Economic Area;
14) Link to the information of the external supplier.
27.3.
The register shall be updated on:
1) adding technology;
2) removing technology;
3) change of supplier;
4) a change of purpose;
5) a change of duration;
6) change of category;
7) a change in international transfers.
27.4.
Technology not specified in the register should not intentionally be used as optional technology.
27.5.
A temporary technical device used solely to address an immediate security problem shall be documented and removed or added to the register if its use continues.
27.6.
Listing possible categories in this policy does not mean that all categories are active.
27.7.
The technologies actually active are those listed in the current register.
28. Changes in cookies and suppliers
28.1.
Before a new optional technology is introduced, the following are checked:
1) the objective;
2) necessity;
3) the category;
4) the supplier;
5) the time limit;
6) the data processed;
7) recipients;
8) international transfers;
9) the need for consent;
10) Technical blocking before choice.
28.2.
A new optional technology is not activated on the basis of previous consent where its new purpose or supplier was not covered by the information provided.
28.3.
If a change is minor and does not expand the purpose or recipients, the register may be updated without requesting a new choice, provided the previous choice remains valid.
29. THIRD-PARTY TECHNOLOGIES
29.1.
The external supplier may receive information where:
1) its component loads;
2) the visitor clicks an external link;
3) The visitor activates built-in content;
4) the visitor starts a payment;
5) the visitor selects an integrated courier function;
6) the visitor uses an external training or videoconferencing service.
29.2.
The external supplier may combine information with information from other services where it has a relevant legal basis.
29.3.
Suppliers acting as independent controllers are responsible for their own processing.
29.4.
When a supplier processes data on behalf of LEAN BULGARIA OOD, relations are settled by contract and appropriate instructions.
29.5.
The choice of external suppliers shall be made taking into account:
1) security;
2) confidentiality;
3) the duration of the technologies;
4) the possibility of pre-blocking;
5) the possibility of withdrawal;
6) international transfers;
7) other applicable requirements.
30. INTERNATIONAL DATA TRANSFERS
30.1.
Some external providers may process information outside the European Economic Area.
30.2.
Where the information is personal data, transfers take place where an applicable mechanism is available, including:
1) an adequacy decision;
2) standard contractual clauses;
3) binding corporate rules;
4) applicable legal exception;
5) another permissible mechanism.
30.3.
Information about international transfers is provided in the register or the Privacy Policy.
30.4.
The consent for a cookie does not automatically replace the requirements for the lawful international transfer of personal data.
31. Retention periods
31.1.
Each technology shall be used for a period corresponding to its purpose.
31.2.
Time limits shall be limited to what is reasonably necessary.
31.3.
Session-based technologies normally cease when the session ends.
31.4.
Persistent technologies are deleted or expire after the period specified in the register.
31.5.
The proof of choice can be kept longer than the cookie itself when it is necessary to prove compliance with the law.
31.6.
Data extracted through technology may have a different storage period specified in the Privacy Policy or the information of the supplier concerned.
32. Security
32.1.
We apply appropriate technical and organisational measures to protect information processed through cookies and similar technologies.
32.2.
The measures may include:
1) secure connection;
2) restriction of access;
3) appropriate attributes of cookies;
4) protection against cross-site attacks;
5) limitation of the time limit;
6) division of categories;
7) management of suppliers;
8) recording administrative changes;
9) periodic scanning;
10) other measures according to the risk.
32.3.
Where technically applicable, strictly necessary authentication technologies are configured to restrict access by client-side scripts and transmission over an insecure connection.
32.4.
No technology can guarantee absolute security, but this does not exempt the Supplier from the obligation to apply appropriate measures.
33. Rights concerning personal data
33.1.
Where the information processed through cookies constitutes personal data, the person may be entitled to:
1) information;
2) access;
3) rectification;
4) erasure;
5) restriction;
6) portability, where applicable;
7) an objection;
8) withdrawal of consent;
9) a complaint to a supervisory authority;
10) Judicial protection.
33.2.
The specific right depends on the type of data, legal basis and circumstances.
33.3.
Where we do not have information allowing the person to be reasonably identified, they may need to provide additional information.
33.4.
Creating a new identifier solely to link anonymous or non-identifying information to a particular person is not required.
33.5.
Detailed information on rights is contained in the Privacy Policy.
34. Exercise of the rights
34.1.
Requests concerning personal data may be sent to:
LEAN BULGARIA OOD
Email: admin@leanchampionscommunity.com
Address: Sofia, 55 Kiril Popov Street, entrance A, floor 1, apartment 4, Republic of Bulgaria
34.2.
The email subject line may state:
Cookies and personal data
34.3.
A written request is not necessary to change or withdraw a choice where this can be done through “Cookie settings”.
34.4.
The GDPR requests shall be dealt with in accordance with the time limits and procedure set out in the Privacy Policy.
35. Complaint to a supervisory authority
35.1.
A person who considers that the processing of personal data infringes applicable law may lodge a complaint with the Commission for Personal Data Protection.
35.2.
Contact details of the Commission for Personal Data Protection:
Address: 2 Prof. Tsvetan Lazarov Boulevard, Sofia 1592, Republic of Bulgaria
E-mail: kzld@cpdp.bg
Website: cpdp.bg
35.3.
Where the issue concerns storing information on, or accessing information from, a terminal device, another competent authority may also have powers under the law.
35.4.
The submission of a complaint shall not be subject to a mandatory prior request to the Supplier.
35.5.
The person shall also have the right to judicial protection.
36. Policy changes
36.1.
This policy may be updated in the event of:
1) change of legislation;
2) changing the technologies used;
3) adding or removing a supplier;
4) introducing a new module;
5) change of objectives;
6) change of time limits;
7) a change in international transfers;
8) change of the consent mechanism;
9) another objective reason.
36.2.
The current version shall contain:
1) version number;
2) date of entry into force;
3) date of latest update.
36.3.
In the event of a substantial change affecting the validity or scope of the previous choice, the visitor shall receive new information and be able to make a new choice.
36.4.
Publishing a new policy does not, by itself, constitute consent to new optional technologies.
36.5.
Previous versions may be archived to demonstrate the information provided.
37. Contacts
37.1.
In the case of questions about cookies and similar technologies you can contact:
LEAN BULGARIA OOD
Unified Identification Code (UIC): 203317933
VAT identification number: BG203317933
Address: Sofia, 55 Kiril Popov Street, entrance A, floor 1, apartment 4, Republic of Bulgaria
Email: admin@leanchampionscommunity.com
Telephone: +359 896 060 911
Website: leanchampionscommunity.com
37.2.
In case of technical problem with the selection panel, specify:
1) the browser used;
2) the device used;
3) the approximate date and time;
4) description of the problem;
5) screenshot, where applicable.
37.3.
Do not send:
1) password;
2) full bank card number;
3) security code;
4) a two-factor authentication code;
5) other unnecessary authentication credentials.
38. Entry into force
38.1.
This Cookie Policy takes effect from the date specified in the “Effective from” field.
38.2.
The specific choice shall be subject to the version of the information shown to the visitor when giving or refusing consent.
38.3.
Where a separate provision is contrary to a binding rule of law, the legal standard shall apply without prejudice to the rest of the policy.
38.4.
The rejection of optional technologies is respected regardless of the content of this policy.
38.5.
The current register of cookies and similar technologies actually used is an integral part of the information provided to visitors.
1. Purpose and scope
1.1.
This Cookie Policy explains how LEAN BULGARIA OOD uses cookies and other similar technologies in connection with Lean Champions Platform, Lean Champions Store and the website leanchampionscommunity.com.
1.2.
The policy shall apply to:
1) visiting the public pages of the Platform;
2) creating and using a user profile;
3) signing in to an individual or corporate account;
4) use of the basket;
5) placing an order;
6) choice of payment method;
7) choice of delivery method;
8) use of paid digital content;
9) using a digital service or subscription;
10) use of the training environment;
11) use of 5S, audit, reporting and other modules;
12) viewing an embedded video, map, external form or other content;
13) granting or refusing consent for optional technologies;
14) using another function that stores information on the terminal device or accesses information already stored there.
1.3.
This policy applies not only to traditional cookies but also to other technologies that can store information on, or read information from, a computer, phone, tablet or other terminal device.
1.4.
This policy shall apply together with:
1) The Privacy Policy;
2) the Terms and Conditions;
3) Delivery and payment policy;
4) the information in the “Cookie settings” panel;
5) the additional information displayed prior to activation of a specific external service;
6) the applicable legislation.
1.5.
The consent for optional cookies is separate from:
1) acceptance of the Terms and Conditions;
2) placing an order;
3) consent to electronic marketing communications;
4) consent to the immediate provision of digital content;
5) the request for early start of a digital service;
6) other contractual or legal statements.
1.6.
Continuing to browse the site, scrolling, closing the banner, taking no action or using the main functions does not constitute consent to optional cookies.
1.7.
Rejecting optional cookies does not restrict the visitor’s mandatory rights or prevent use of the Platform’s main content and strictly necessary functions.
2. SUPPLIER DETAILS
2.1.
The supplier of Lean Champions Platform and controller of personal data processed for its own purposes described in this policy is:
LEAN BULGARIA OOD
Unified Identification Code (UIC): 203317933
VAT identification number: BG203317933
Registered office and management address: Sofia, 55 Kiril Popov Street, entrance A, floor 1, apartment 4, Republic of Bulgaria
Manager: Todor Neychev
Email: admin@leanchampionscommunity.com
Telephone: +359 896 060 911
Website: leanchampionscommunity.com
hereinafter referred to as the “Merchant”, “Supplier”, “Controller”, “we”, “us” or “our”.
3. WHAT COOKIES ARE
3.1.
Cookies are small files or pieces of information that a website can store in a visitor’s browser or terminal device.
3.2.
On a subsequent visit, the browser may return the relevant information to the website or to the supplier that placed the technology.
3.3.
Cookies can allow the Platform to:
1) maintain an active user session;
2) recognise that the user is signed in to their account;
3) remember the contents of the basket;
4) protect forms and payments;
5) remember selected settings;
6) record cookie preferences;
7) identify technical problems;
8) measure page usage;
9) provide external content;
10) measure the effectiveness of an advertising campaign;
11) perform another function explained in advance.
3.4.
A cookie may contain a unique identifier but does not normally directly contain a name, address or full payment-card number.
3.5.
Information collected through cookies may constitute personal data where it allows the direct or indirect identification or differentiation of a natural person.
3.6.
The requirements for storing information on, or reading information from, a terminal device may also apply where the information itself is not personal data.
4. Similar technologies
4.1.
In addition to cookies, the Platform may use similar technologies, including:
1) local storage in the browser;
2) session storage;
3) pixels;
4) tags;
5) scripts;
6) software development kits;
7) device identifiers;
8) technologies for measuring openings and interactions;
9) security tokens;
10) fraud prevention technologies;
11) other technical means of storing information on, or accessing information from, the terminal device.
4.2.
The rules of this policy apply to these technologies according to their purpose, operation and legal basis.
4.3.
When a new technology is introduced, its purpose, supplier, duration and category are added to the register of technologies used before it is activated for visitors.
5. FIRST-PARTY AND THIRD-PARTY COOKIES
5.1.
A first-party cookie is a cookie placed or managed by the Lean Champions Platform domain.
5.2.
A third-party cookie is a cookie placed or managed by an external supplier through an integrated service, external resource, embedded content or redirect.
5.3.
External suppliers may include:
1) payment operators;
2) courier and logistics providers;
3) video content platforms;
4) mapping services;
5) videoconferencing services;
6) training platforms;
7) analytics services;
8) advertising platforms;
9) cybersecurity providers;
10) other technical suppliers.
5.4.
Listing a category in this policy does not mean that every possible external service is actually active.
5.5.
The current suppliers and technologies are listed in the register accessible through “Cookie settings”.
6. Session and persistent cookies
6.1.
Session cookies normally remain active only while the browser is open and are deleted when the session ends, unless their technical characteristics provide otherwise.
6.2.
Persistent cookies remain on the device for a predetermined period or until the user deletes them.
6.3.
The duration of each persistent cookie is determined according to:
1) its purpose;
2) necessity;
3) the risk to privacy;
4) security requirements;
5) the duration set by the relevant supplier;
6) the applicable legislation.
6.4.
The specific duration of each active technology shall be indicated in the cookie register.
7. Rules on storage and access to information
7.1.
Information is stored on, or accessed from, the terminal device:
1) after providing clear and comprehensive information;
2) after providing a real choice;
3) after valid prior consent where the technology is not strictly necessary;
4) without consent only where the legal exception for strictly necessary technology is applicable.
7.2.
A technology is strictly necessary where its use is objectively necessary:
1) solely to transmit a communication over an electronic communications network;
2) to provide an information society service explicitly requested by the user.
7.3.
The Supplier’s convenience, a general desire for statistics, advertising or an improved user experience do not, by themselves, make a technology strictly necessary.
7.4.
In the case of optional technology, the consent shall be:
1) freely given;
2) specific;
3) informed;
4) unambiguous;
5) given by clear affirmative action;
6) demonstrable;
7) capable of being withdrawn at any time.
7.5.
The consent shall not be derived from:
1) silence;
2) inaction;
3) a pre-ticked checkbox;
4) continuing to browse;
5) scrolling;
6) closing the window;
7) pressing a button for another primary purpose;
8) general acceptance of the Terms and Conditions.
8. Technology categories
8.1.
According to their purpose, technologies may be divided into:
1) strictly necessary;
2) functionality and preferences;
3) analytics and performance;
4) marketing and advertising;
5) external content and social functions;
6) other clearly described categories.
8.2.
All categories other than strictly necessary technologies are disabled by default until the visitor makes a valid choice.
8.3.
Where a technology has more than one purpose, it is classified according to all of its actual purposes, and consent is determined by the purpose requiring the higher level of protection.
8.4.
Technology is not marked as strictly necessary only to avoid the requirement of consent.
9. Strictly necessary cookies
9.1.
The strictly necessary technologies provide basic features explicitly requested by the visitor.
9.2.
They may be used for:
1) creating and maintaining a protected session;
2) signing in to a user account;
3) authentication of identity;
4) protection against forged requests;
5) protection of forms;
6) preventing unauthorised access;
7) management of the basket;
8) remembering selected products during the ordering process;
9) remembering the selected delivery method during the order;
10) maintaining the technical connection;
11) load balancing;
12) remembering cookie preferences;
13) prevention of fraud;
14) enabling a payment explicitly initiated by the Customer;
15) another function without which the explicitly requested service cannot be technically provided.
9.3.
Strictly necessary technologies are not used for:
1) profiling for advertising;
2) tracking between unrelated websites;
3) measuring advertising campaigns;
4) creation of marketing audiences;
5) general analytics that are not necessary to provide the explicitly requested service.
9.4.
Consent is not requested for strictly necessary technologies, but information about them is provided.
9.5.
The user may block some of these technologies through their browser, but this may make it impossible to:
1) sign in to an account;
2) retain a basket;
3) making an order;
4) protection of a form;
5) using another basic functionality.
10. Security and authentication cookies
10.1.
Security technologies may be used for:
1) recognition of a valid session;
2) detecting failed sign-in attempts;
3) limiting automated attacks;
4) prevention of fraud;
5) protection of administrative functions;
6) protection of payments;
7) detection of abnormal behaviour;
8) maintaining the integrity of requests;
9) another necessary protective function.
10.2.
Where protective technology is objectively necessary for the secure provision of the explicitly requested service, it may be classified as strictly necessary.
10.3.
A security technology is not used for unrelated marketing or profiling without a separate applicable legal basis and consent.
11. Basket and ordering process
11.1.
The platform may use strictly necessary technologies for:
1) adding a product to the basket;
2) keeping the selected quantity;
3) calculating the final price;
4) connecting individual steps of the order;
5) maintaining the chosen method of payment;
6) maintaining the chosen delivery method;
7) preventing duplicate submission;
8) preventing loss of the order when moving between pages.
11.2.
Technology necessary only to preserve the basket for an extended marketing period after leaving the site is not automatically considered strictly necessary.
11.3.
An abandoned basket is used for marketing only where there is an applicable legal basis and the relevant information has been provided.
12. Payments and myPOS
12.1.
When the Customer selects card payment and starts the payment process, they may be redirected to the secure myPOS environment.
12.2.
myPOS may use its own strictly necessary technologies for:
1) secure processing of payment;
2) authentication of the transaction;
3) prevention of fraud;
4) maintaining the payment session;
5) fulfilling regulatory requirements.
12.3.
These technologies can be activated when the Customer explicitly selects a card payment and starts the payment process.
12.4.
myPOS may act as an independent controller for its own processing and provides separate information about its technologies and processing of personal data.
12.5.
Lean Champions Platform does not use the information from the payment environment for marketing tracking without a separate applicable basis.
12.6.
A payment component which includes optional analytical or advertising technologies should not activate these technologies without the necessary consent.
13. Delivery and courier functions
13.1.
When the Customer uses an integrated function to select an Econt or other courier office, address or service, technologies necessary to perform the explicitly requested action may be used.
13.2.
Such technologies may be used for:
1) loading a list of offices;
2) selecting a town or other locality;
3) calculating delivery costs;
4) keeping the selected office within the order;
5) technical interaction with the courier service.
13.3.
Where the integration includes the courier’s optional analytics or marketing technologies, these are activated only with the applicable consent.
13.4.
The courier may process personal data and use technologies as an independent controller in providing its service.
14. Functional cookies and preferences
14.1.
Functional technologies allow the Platform to remember choices and settings that are not strictly necessary for the main service.
14.2.
They can be used for:
1) preferred language;
2) selected view;
3) text or interface size;
4) last-used section;
5) Video preferences;
6) dashboard settings;
7) convenience features for return visits;
8) other personalised settings.
14.3.
Functional technologies shall be activated after consent, unless the specific technology is strictly necessary for a function explicitly requested by the user.
14.4.
If functional technologies are rejected, the Platform remains accessible, but some settings may not be remembered between visits.
15. ANALYTICS COOKIES AND PERFORMANCE TECHNOLOGIES
15.1.
Analytical technologies may be used to obtain statistical information on:
1) number of visits;
2) pages used;
3) loading time;
4) technical errors;
5) the browsing sequence;
6) the type of device used;
7) the overall interface efficiency;
8) interaction with certain functions;
9) the source of the visit;
10) other indicators for the use of the Platform.
15.2.
Information may be used for:
1) improving navigation;
2) detection of technical difficulties;
3) Evaluation of the use of functionalities;
4) development planning;
5) the creation of statistical reports.
15.3.
Analytical technologies that are not strictly necessary to provide the explicitly requested service shall be activated only after prior consent.
15.4.
Using analytics information in aggregated or pseudonymised form does not automatically remove the requirement for consent to the initial storage of information on, or reading of information from, the device.
15.5.
Where technically possible, the analytical settings shall be configured to:
1) collect a minimum amount of data;
2) limit the retention period;
3) limit sharing;
4) exclude advertising functions;
5) truncate or pseudonymise identifiers;
6) do not create profiles for unrelated purposes.
15.6.
If analytics technologies are rejected, the Platform’s main functions continue to work.
16. Marketing and advertising technologies
16.1.
Marketing technologies can be used for:
1) measuring an advertising campaign;
2) identifying whether a visitor reached the Platform through an advertisement;
3) limiting the frequency of display of advertising;
4) the creation of audiences;
5) personalising advertising content;
6) reaching visitors again through an external platform;
7) connecting interactions between different websites or applications;
8) other advertising purposes.
16.2.
Marketing technologies are not strictly necessary for the use of the Platform.
16.3.
They shall only be activated after prior, specific and informed consent.
16.4.
The refusal of marketing technology does not necessarily mean that the visitor will not see advertising, but that advertising should not be personalised through the refused technologies.
16.5.
Consent to marketing cookies does not automatically constitute consent to receive electronic marketing communications.
16.6.
Consent to an email newsletter does not automatically constitute consent to marketing cookies.
17. External video, maps and other embedded content
17.1.
The platform may contain embedded elements from external suppliers, including:
1) videos;
2) maps;
3) presentations;
4) audio materials;
5) forms;
6) training resources;
7) social media posts;
8) other external components.
17.2.
The external supplier may place their cookies or obtain technical information including IP address, device, browser and interaction with the content.
17.3.
An external component that is not strictly necessary is not loaded before the necessary consent is obtained.
17.4.
Instead of loading it automatically, the following may be displayed:
1) a static placeholder;
2) a privacy notice;
3) a “Load content” button;
4) possibility to activate the relevant category.
17.5.
When a visitor explicitly chooses to load specific external content, they receive information about the supplier and the technologies that may be used.
17.6.
Where reasonably possible, an alternative means of accessing basic information without activation of external marketing technologies shall be provided.
18. Social networks and sharing buttons
18.1.
An ordinary link to a social network must not, by itself, activate tracking technology before the visitor clicks the link.
18.2.
An embedded social-network button, post or component may transmit information to the relevant platform.
18.3.
Where such a component uses optional technologies, it is loaded only after consent or an explicit action taken after appropriate information has been provided.
18.4.
After visiting the social network, its operator processes data according to its own terms and policies.
19. Cookie banner
19.1.
Upon first visit or where a renewal of the selection is required, a cookie management window shall be displayed.
19.2.
The first layer of the window shall provide clear information on:
1) the use of cookies and similar technologies;
2) the main objectives;
3) the existence of optional categories;
4) the right to refuse optional technologies;
5) the right to change or withdraw the choice at any time;
6) a link to this policy.
19.3.
The first layer provides clearly visible options to:
1) “Accept all”;
2) “Reject optional cookies”;
3) open “Cookie settings”.
19.4.
The option to reject is not hidden in lengthy text, outside the window or behind a visually inconspicuous link.
19.5.
Buttons and text are not designed misleadingly to steer the visitor unjustifiably towards acceptance.
19.6.
The following are not used:
1) pre-ticked categories;
2) misleading colours;
3) vague double negatives;
4) an incorrectly labelled close button;
5) a claim that cookies are mandatory when they are not;
6) repeated pressure to accept after a valid rejection;
7) another manipulative structure.
19.7.
The Platform’s main content is not made inaccessible merely because a visitor rejects optional technologies.
19.8.
A specific external function may remain unavailable where technically it cannot be provided without a chosen technology, but this is clearly explained and, where reasonably possible, an alternative is provided.
20. “Cookie settings” panel
20.1.
The panel allows the visitor to:
1) see the different categories;
2) obtain information about the purposes;
3) enable or disable each optional category;
4) accept all;
5) reject all optional technologies;
6) save a customised choice;
7) withdraw previous consent;
8) open the current register of technologies.
20.2.
Strictly necessary technologies may be labelled as always active.
20.3.
For each optional category the switch is switched off by default.
20.4.
Categories are not grouped in a way that forces the visitor to accept unrelated purposes simultaneously.
20.5.
Where individual suppliers process data for materially different purposes, the information shall be provided with sufficient detail.
21. Giving consent
21.1.
The visitor gives consent by:
1) clicking “Accept all”;
2) enabling selected categories and clicking “Save preferences”;
3) another clear affirmative action, which is specifically related to the chosen technology.
21.2.
Before consent, optional technologies remain blocked.
21.3.
The consent shall only concern:
1) the selected categories;
2) the objectives described;
3) those suppliers;
4) the current version of the settings.
21.4.
Consent is not used for a materially different new purpose without new information and, where necessary, a new choice.
21.5.
If a new supplier or purpose is added that is not covered by the previous choice, the relevant technology is not activated on the basis of the previous consent.
22. Refusal of optional cookies
22.1.
The visitor can reject all optional technologies using the “Reject optional cookies” button.
22.2.
If optional technologies are rejected:
1) the strictly necessary technologies remain active;
2) analytical technologies are not activated;
3) marketing technologies are not activated;
4) optional functional technologies are not activated;
5) optional external content may remain blocked.
22.3.
Rejection does not result in:
1) additional price;
2) refusal of service;
3) loss of a legal right;
4) automatic termination of the profile;
5) inability to browse the main public information.
22.4.
If the visitor makes no choice, optional technologies remain disabled.
23. Withdrawal and modification of consent
23.1.
The consent may be withdrawn at any time.
23.2.
Withdrawing consent must be as easy as giving it.
23.3.
A permanently accessible “Cookie settings” link is provided at the bottom of the pages or in another easy-to-find location.
23.4.
Using this link, the visitor can:
1) view their current choice;
2) disable individual categories;
3) to refuse all optional technologies;
4) to make a new choice.
23.5.
Withdrawal takes effect for future use of the relevant technologies.
23.6.
Withdrawal does not affect the lawfulness of processing carried out before it.
23.7.
Where technically possible, after withdrawal, the Platform removes its optional cookies.
23.8.
Some previously stored third party technologies may need to be deleted by:
1) browser settings;
2) the relevant supplier’s tool;
3) another technical option provided.
23.9.
Changing the settings must not require more steps than the initial acceptance.
24. Duration of the choice and renewed requests
24.1.
The choice concerning cookies shall be remembered for the period specified in the consent technology register.
24.2.
The choice is not treated as having an indefinite duration.
24.3.
A new choice may be requested when:
1) expiry of the reasonable period of the previous choice;
2) a substantial change of objectives;
3) adding a new category;
4) adding a new supplier with a substantially different activity;
5) change of legal requirements;
6) losing or erasing the selection information;
7) there are reasonable doubts about the validity of the previous consent.
24.4.
The window is not shown unduly often after a valid rejection solely to pressure the visitor to change their decision.
24.5.
If the visitor deletes the cookie that stores their choice, the Platform may not recognise the previous setting and may display the window again.
25. Recording and demonstrating the choice
25.1.
To prove and manage the choice we can store:
1) random consent identifier;
2) date and time;
3) selected categories;
4) rejected categories;
5) version of the window;
6) version of the Cookies Policy;
7) language;
8) domain;
9) technical source of choice;
10) Limited technical information necessary to demonstrate the choice.
25.2.
No more information shall be collected than reasonably necessary to demonstrate and apply the choice.
25.3.
The consent record may also be stored after its withdrawal where necessary for:
1) proof of legality;
2) giving effect to the objection;
3) preventing reactivation;
4) protection of legal claims.
25.4.
The detailed time limits shall be determined in accordance with the Privacy Policy.
26. Browser management
26.1.
Most browsers allow:
1) review of stored cookies;
2) deleting individual cookies or all cookies;
3) blocking first-party cookies;
4) blocking third-party cookies;
5) deleting cookies on closing the browser;
6) limiting local storage;
7) managing site permissions.
26.2.
The control mode depends on the browser and device used.
26.3.
Blocking all cookies can lead to:
1) inability to sign in;
2) losing the basket;
3) Inability to send a protected form;
4) inability to save cookie preferences;
5) incorrect operation of other basic functions.
26.4.
Deleting cookies through the browser does not replace withdrawing consent where the visitor wants the Platform to remember their rejection.
26.5.
We recommend first changing the choice through “Cookie settings” and then, if necessary, deleting the existing files through the browser.
27. Register of used cookies and technologies
27.1.
The current register is provided via the panel "Cookie settings" or by a separate easily accessible section of this page.
27.2.
For each active technology, the register shall contain, where applicable:
1) name;
2) supplier;
3) domain;
4) category;
5) objective;
6) a description of the information processed;
7) whether it is first-party or third-party;
8) whether it is session-based or persistent;
9) period of validity;
10) activation moment;
11) a legal basis;
12) third party access information;
13) information about transfers outside the European Economic Area;
14) Link to the information of the external supplier.
27.3.
The register shall be updated on:
1) adding technology;
2) removing technology;
3) change of supplier;
4) a change of purpose;
5) a change of duration;
6) change of category;
7) a change in international transfers.
27.4.
Technology not specified in the register should not intentionally be used as optional technology.
27.5.
A temporary technical device used solely to address an immediate security problem shall be documented and removed or added to the register if its use continues.
27.6.
Listing possible categories in this policy does not mean that all categories are active.
27.7.
The technologies actually active are those listed in the current register.
28. Changes in cookies and suppliers
28.1.
Before a new optional technology is introduced, the following are checked:
1) the objective;
2) necessity;
3) the category;
4) the supplier;
5) the time limit;
6) the data processed;
7) recipients;
8) international transfers;
9) the need for consent;
10) Technical blocking before choice.
28.2.
A new optional technology is not activated on the basis of previous consent where its new purpose or supplier was not covered by the information provided.
28.3.
If a change is minor and does not expand the purpose or recipients, the register may be updated without requesting a new choice, provided the previous choice remains valid.
29. THIRD-PARTY TECHNOLOGIES
29.1.
The external supplier may receive information where:
1) its component loads;
2) the visitor clicks an external link;
3) The visitor activates built-in content;
4) the visitor starts a payment;
5) the visitor selects an integrated courier function;
6) the visitor uses an external training or videoconferencing service.
29.2.
The external supplier may combine information with information from other services where it has a relevant legal basis.
29.3.
Suppliers acting as independent controllers are responsible for their own processing.
29.4.
When a supplier processes data on behalf of LEAN BULGARIA OOD, relations are settled by contract and appropriate instructions.
29.5.
The choice of external suppliers shall be made taking into account:
1) security;
2) confidentiality;
3) the duration of the technologies;
4) the possibility of pre-blocking;
5) the possibility of withdrawal;
6) international transfers;
7) other applicable requirements.
30. INTERNATIONAL DATA TRANSFERS
30.1.
Some external providers may process information outside the European Economic Area.
30.2.
Where the information is personal data, transfers take place where an applicable mechanism is available, including:
1) an adequacy decision;
2) standard contractual clauses;
3) binding corporate rules;
4) applicable legal exception;
5) another permissible mechanism.
30.3.
Information about international transfers is provided in the register or the Privacy Policy.
30.4.
The consent for a cookie does not automatically replace the requirements for the lawful international transfer of personal data.
31. Retention periods
31.1.
Each technology shall be used for a period corresponding to its purpose.
31.2.
Time limits shall be limited to what is reasonably necessary.
31.3.
Session-based technologies normally cease when the session ends.
31.4.
Persistent technologies are deleted or expire after the period specified in the register.
31.5.
The proof of choice can be kept longer than the cookie itself when it is necessary to prove compliance with the law.
31.6.
Data extracted through technology may have a different storage period specified in the Privacy Policy or the information of the supplier concerned.
32. Security
32.1.
We apply appropriate technical and organisational measures to protect information processed through cookies and similar technologies.
32.2.
The measures may include:
1) secure connection;
2) restriction of access;
3) appropriate attributes of cookies;
4) protection against cross-site attacks;
5) limitation of the time limit;
6) division of categories;
7) management of suppliers;
8) recording administrative changes;
9) periodic scanning;
10) other measures according to the risk.
32.3.
Where technically applicable, strictly necessary authentication technologies are configured to restrict access by client-side scripts and transmission over an insecure connection.
32.4.
No technology can guarantee absolute security, but this does not exempt the Supplier from the obligation to apply appropriate measures.
33. Rights concerning personal data
33.1.
Where the information processed through cookies constitutes personal data, the person may be entitled to:
1) information;
2) access;
3) rectification;
4) erasure;
5) restriction;
6) portability, where applicable;
7) an objection;
8) withdrawal of consent;
9) a complaint to a supervisory authority;
10) Judicial protection.
33.2.
The specific right depends on the type of data, legal basis and circumstances.
33.3.
Where we do not have information allowing the person to be reasonably identified, they may need to provide additional information.
33.4.
Creating a new identifier solely to link anonymous or non-identifying information to a particular person is not required.
33.5.
Detailed information on rights is contained in the Privacy Policy.
34. Exercise of the rights
34.1.
Requests concerning personal data may be sent to:
LEAN BULGARIA OOD
Email: admin@leanchampionscommunity.com
Address: Sofia, 55 Kiril Popov Street, entrance A, floor 1, apartment 4, Republic of Bulgaria
34.2.
The email subject line may state:
Cookies and personal data
34.3.
A written request is not necessary to change or withdraw a choice where this can be done through “Cookie settings”.
34.4.
The GDPR requests shall be dealt with in accordance with the time limits and procedure set out in the Privacy Policy.
35. Complaint to a supervisory authority
35.1.
A person who considers that the processing of personal data infringes applicable law may lodge a complaint with the Commission for Personal Data Protection.
35.2.
Contact details of the Commission for Personal Data Protection:
Address: 2 Prof. Tsvetan Lazarov Boulevard, Sofia 1592, Republic of Bulgaria
E-mail: kzld@cpdp.bg
Website: cpdp.bg
35.3.
Where the issue concerns storing information on, or accessing information from, a terminal device, another competent authority may also have powers under the law.
35.4.
The submission of a complaint shall not be subject to a mandatory prior request to the Supplier.
35.5.
The person shall also have the right to judicial protection.
36. Policy changes
36.1.
This policy may be updated in the event of:
1) change of legislation;
2) changing the technologies used;
3) adding or removing a supplier;
4) introducing a new module;
5) change of objectives;
6) change of time limits;
7) a change in international transfers;
8) change of the consent mechanism;
9) another objective reason.
36.2.
The current version shall contain:
1) version number;
2) date of entry into force;
3) date of latest update.
36.3.
In the event of a substantial change affecting the validity or scope of the previous choice, the visitor shall receive new information and be able to make a new choice.
36.4.
Publishing a new policy does not, by itself, constitute consent to new optional technologies.
36.5.
Previous versions may be archived to demonstrate the information provided.
37. Contacts
37.1.
In the case of questions about cookies and similar technologies you can contact:
LEAN BULGARIA OOD
Unified Identification Code (UIC): 203317933
VAT identification number: BG203317933
Address: Sofia, 55 Kiril Popov Street, entrance A, floor 1, apartment 4, Republic of Bulgaria
Email: admin@leanchampionscommunity.com
Telephone: +359 896 060 911
Website: leanchampionscommunity.com
37.2.
In case of technical problem with the selection panel, specify:
1) the browser used;
2) the device used;
3) the approximate date and time;
4) description of the problem;
5) screenshot, where applicable.
37.3.
Do not send:
1) password;
2) full bank card number;
3) security code;
4) a two-factor authentication code;
5) other unnecessary authentication credentials.
38. Entry into force
38.1.
This Cookie Policy takes effect from the date specified in the “Effective from” field.
38.2.
The specific choice shall be subject to the version of the information shown to the visitor when giving or refusing consent.
38.3.
Where a separate provision is contrary to a binding rule of law, the legal standard shall apply without prejudice to the rest of the policy.
38.4.
The rejection of optional technologies is respected regardless of the content of this policy.
38.5.
The current register of cookies and similar technologies actually used is an integral part of the information provided to visitors.