Privacy Policy
Privacy policy and protection of personal data
1. Purpose and scope
1.1.
This Privacy Policy governs the way that LEAN BULGARIA OOD collects, receives, uses, stores, organizes, changes, provides, restricts, deletes and otherwise processes personal data in relation to Lean Champions Platform, Lean Champions Store and related products, services and functionalities.
1.2.
The policy shall apply to:
1) visiting and using the website leanchampionscommunity.com;
2) creating and using a user profile;
3) use of an individual, team or corporate profile;
4) placing and fulfilling orders;
5) purchase and delivery of physical goods;
6) purchase and supply of digital content;
7) activation and use of digital services;
8) purchase and use of subscription access;
9) participation in distance, online or in-person training;
10) participation in webinars, seminars, events and consultations;
11) use of 5S, audit, reporting, training and other Platform modules;
12) submitting an enquiry, notice of withdrawal, return request, product complaint, other complaint or other request;
13) making payment through myPOS, bank transfer, cash on delivery or other active method;
14) communication with the merchant;
15) receiving contractual, informational or marketing messages;
16) use of cookies and similar technologies;
17) ensuring the security and proper functioning of the Platform.
1.3.
The policy shall apply to the personal data of:
1) visitors to the website;
2) registered users;
3) clients and recipients of orders;
4) participants in training;
5) representatives, employees and contact persons of corporate clients;
6) administrators of company profiles;
7) persons included in uploaded material, photos, audits, reports or other records;
8) persons associated with the merchant;
9) persons exercising rights under the legislation on the protection of personal data;
10) other natural persons whose data are lawfully processed through the Platform.
1.4.
Data concerning legal persons shall not constitute personal data unless the information identifies or may be related to a specific natural person, such as a manager, employee, representative or contact person.
1.5.
This Policy provides information under Regulation (EU) 2016/679, referred to below as the ‘GDPR’, the Personal Data Protection Act and other applicable legislation.
1.6.
Reading this Privacy Policy does not constitute consent to all the processing activities described.
1.7.
Where processing requires consent, it is requested separately, for a specific purpose, through a clear affirmative action and without a pre-ticked box.
1.8.
The policy shall apply together with:
1) the Terms and Conditions;
2) Cookies Policy;
3) Delivery and payment policy;
4) The policy on the right of withdrawal;
5) Return policy;
6) The complaint policy;
7) the conditions of the particular product or service;
8) the additional notifications shown in individual functionalities;
9) personal data processing contracts with corporate clients where applicable.
2. Data controller
2.1.
The controller responsible for processing personal data for its own purposes in connection with Lean Champions Platform and Lean Champions Store is:
LEAN BULGARIA OOD
Unified Identification Code (UIC): 203317933
VAT identification number: BG203317933
Registered office and management address: Sofia, 55 Kiril Popov Street, entrance A, floor 1, apartment 4, Republic of Bulgaria
Manager: Todor Neychev
Email: admin@leanchampionscommunity.com
Telephone: +359 896 060 911
Website: leanchampionscommunity.com
referred to below as the ‘Merchant’, the ‘Controller’, ‘we’, ‘us’ or ‘our’.
2.2.
For questions about personal data protection, the subject line of your email may state:
Personal data.
2.3.
The Merchant determines the purposes and means of processing personal data when acting as a controller.
2.4.
When processing data on behalf of a corporate client and solely on its documented instructions, the Merchant may act as a processor.
3. Basic concepts
3.1.
“Personal data” means any information relating to an identified or identifiable natural person.
3.2.
The data subject is the natural person to whom the personal data relate.
3.3.
“Processing” means any operation or set of operations on personal data, including collection, recording, organisation, structuring, storage, alteration, retrieval, consultation, use, disclosure, restriction, erasure or destruction.
3.4.
“Controller” means the person who determines the purposes and means of processing.
3.5.
The processor is the person who processes personal data on behalf of the controller.
3.6.
“Recipient” means a person, organisation or authority to which personal data are disclosed.
3.7.
“Consent” means a freely given, specific, informed and unambiguous indication of the data subject’s wishes.
3.8.
“Pseudonymisation” means processing that prevents data from being attributed to a specific person without additional information kept separately.
3.9.
‘Anonymised data’ means data that cannot reasonably be linked to a specific natural person.
3.10.
A ‘personal data breach’ is a breach leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.
3.11.
"Corporate client" is an organisation that buys or manages access to the Platform for its employees, representatives, counterparties or other authorised users.
3.12.
‘Client content’ means the information, documents, photographs, recordings, audits, reports, tasks, comments and other data entered or uploaded by a client or its users.
4. Roles in Processing
4.1.
The Merchant acts as an independent controller for data processed for:
1) website management;
2) registration and management of user profiles;
3) conclusion and execution of contracts;
4) processing of orders;
5) payments and accounting;
6) supply of physical goods;
7) provision of digital content and digital services;
8) conducting training;
9) customer service;
10) handling withdrawals, returns and product complaints;
11) security protection;
12) prevention of fraud;
13) the fulfilment of legal obligations;
14) protection of legal claims;
15) own marketing communication.
4.2.
The corporate client normally acts as a controller for personal data that it or its users enter into the Platform for its own organisational purposes, including data concerning:
1) employees;
(2) operators;
3) managers;
4) auditors;
5) participants in 5S checks;
6) persons responsible for corrective actions;
7) participants in training;
8) internal users;
9) other persons designated by the corporate client.
4.3.
When processing client content on the documented instructions of the corporate client, the Merchant may act as a processor.
4.4.
The relationship between the corporate client and the Merchant may be further governed by a personal data processing agreement or addendum.
4.5.
The corporate client shall be responsible for:
1) having a valid legal basis for the data entered;
2) providing the necessary information to the individuals concerned;
3) entering only data necessary for its lawful purposes;
4) assigning appropriate access rights;
5) updating and correcting inaccurate data;
6) not using the Platform for unlawful surveillance;
7) not uploading unnecessary special categories of data;
8) giving lawful instructions to the Merchant.
4.6.
Where a data subject submits a request about data for which the corporate client is the controller, the Merchant may:
1) forward the request to the corporate client;
2) inform the individual who the relevant controller is;
3) assist the corporate client within the scope of its contractual and legal obligations.
4.7.
The Merchant does not independently determine the purposes for which the corporate client uses the internal data it uploads, except for the Merchant’s own security, maintenance, invoicing and legal compliance purposes.
5. Processing principles
5.1.
Personal data shall be processed in accordance with the following principles:
1) lawfulness;
2) fairness;
3) transparency;
4) purpose limitation;
5) data minimisation;
6) accuracy;
7) storage limitation;
8) integrity;
9) confidentiality;
10) accountability.
5.2.
The Merchant aims to process only personal data that are adequate, relevant and limited to what is necessary for the specific purpose.
5.3.
The Merchant takes reasonable steps to correct or erase inaccurate data when informed of the inaccuracy.
5.4.
Personal data are not used for a new, incompatible purpose without an additional legal basis and the necessary information being provided to the data subject.
6. Categories of data subjects
6.1.
We may process personal data relating to:
1) visitors to the Platform;
2) customers;
3) recipients of consignments;
4) payers;
5) bank account holders;
6) registered users;
7) Profile administrators;
8) representatives of legal entities;
9) employees and associates of corporate clients;
10) participants in trainings and events;
11) trainers and lecturers;
12) persons making inquiries;
13) persons applying for withdrawal;
14) persons making claims;
15) individuals included in user content;
16) visitors, whether or not they refused to consent to cookies;
17) individuals who have subscribed to marketing communications;
18) persons for whom we are obliged to process data under law.
7. Identification data
7.1.
Depending on the service used, we can process:
1) name;
2) last name;
3) username;
4) internal profile identifier;
5) client number;
6) participant number;
7) certificate number;
8) a signature, where required for a paper document;
9) a position;
10) organisation;
11) Department;
12) professional role;
13) a work identifier, where entered by a corporate client;
14) other identification information necessary for the specific service.
7.2.
As a rule, we do not require a Bulgarian personal identification number (EGN), identity card number or copy of an identity document for ordinary registration or an order.
7.3.
An identity document may be requested only where lawful, necessary and proportionate, for example to verify identity in relation to a specific request or to prevent fraud.
7.4.
Where this is sufficient, unnecessary data in the document must be redacted.
8. Contact details
8.1.
We can process:
1) e-mail address;
2) telephone number;
3) delivery address;
4) billing address;
5) address for correspondence;
6) Selected courier office;
7) locality;
8) postal code;
9) country;
10) business contact details;
11) Preferred communication channel.
9. User profile data
9.1.
When creating and using a profile we can process:
1) username;
2) email address;
3) a cryptographically protected representation of the password;
4) role and level of access;
5) organisation;
6) language settings;
7) Profile settings;
8) date of registration;
9) date of confirmation of the e-mail address;
10) date of last sign-in;
11) Profile status;
12) activated products and modules;
13) start and end of access;
14) number of authorised users;
15) History of changes in the profile;
16) information about invitations to other users;
17) used functions;
18) administrative actions;
19) information about the blocking, restoration or termination of access.
9.2.
Passwords are not stored as visible, readable text when the system is technically configured in accordance with the security measures applied.
9.3.
The Merchant never asks users to send their passwords by email.
10. Order details
10.1.
When performing an order we can process:
1) order number;
2) date and time;
3) selected products and services;
4) quantities;
5) unit and total prices;
6) applied discounts;
7) currency;
8) taxes;
9) delivery costs;
10) chosen method of payment;
11) Selected delivery method;
12) the status of the order;
13) history of changes;
14) contractual consents granted;
15) version of the accepted Terms and Conditions;
16) version of policies;
17) date and time of the explicit consents given;
18) activation information;
19) cancellation information;
20) refund information;
21) contractual correspondence;
22) other data necessary to implement and prove the contract.
11. Delivery data
11.1.
For delivery of physical goods we can process:
1) name of the recipient;
2) telephone;
(3) email address;
4) address;
5) Selected office of Econt;
6) Additional delivery instructions;
7) shipment tracking or waybill number;
8) value of the consignment;
9) cash-on-delivery amount;
10) details of the consignment’s contents to the extent necessary;
11) Delivery status;
12) date of dispatch;
13) date of receipt;
14) information on the consignment not received or returned;
15) damage reports;
16) communication with the courier;
17) other information required for the courier service.
11.2.
Data are provided to the courier only to the extent necessary for delivery, collection of cash-on-delivery payments, tracking and resolving problems.
12. Data on card payments through myPOS
12.1.
When payment is made by bank card through myPOS, the Merchant may receive and retain limited information, such as:
1) transaction identifier;
2) order number;
3) amount and currency;
4) date and time;
5) status of payment;
6) status of refund;
7) partially masked payment instrument data where provided;
8) type of card scheme;
9) code or description of the result;
10) information necessary to prevent fraud;
11) correspondence on payment;
12) details of disputes, refunds or payment reversals.
12.2.
The Merchant does not receive or store:
1) the full number of the bank card;
2) the security code;
3) the personal identification number;
4) password for banking application;
5) complete payment card authentication data.
12.3.
Full payment details are entered in the secure environment of myPOS or another designated, licensed payment service provider.
12.4.
myPOS may process personal data as an independent controller for the provision of the payment service, fraud prevention, regulatory obligations and other own legal purposes.
12.5.
Processing by myPOS is also governed by its own privacy information.
13. Bank transfer data
13.1.
When payment by bank transfer is activated, we may process:
1) name of the payer;
2) name of the account holder;
3) IBAN;
4) BIC;
5) Bank;
6) amount and currency of the transfer;
7) date of order and receipt;
8) reason for payment;
9) order number;
10) status of payment;
11) data on partial, overpaid or late payment;
12) refund information;
13) correspondence about the transfer.
13.2.
Bank data shall be used for:
1) identification of the payment;
2) connection to the order;
3) accounting;
4) refund of an amount;
5) preventing errors and fraud;
6) fulfillment of legal obligations.
13.3.
Banks and payment service providers also process data as independent controllers in accordance with their own legal obligations.
14. Invoicing and accounting data
14.1.
When issuing accounting documents, we can process:
1) name and surname;
2) name of organisation;
3) EIC or other registration number;
4) VAT identification number;
5) address;
6) name of the representing person;
7) contact person;
8) e-mail address;
9) order details;
10) payment details;
11) content and value of the invoice;
12) other details required by law.
14.2.
Information relating solely to a legal person is not personal data, but data relating to representatives, contact persons and natural persons are protected under this Policy.
15. Digital content and platform access data
15.1.
When providing digital content or digital service we can process:
1) purchased product;
2) activated plan;
3) activated modules;
4) date and time of activation;
5) start and end dates;
6) number of authorised users;
7) downloads;
8) access to materials;
9) progress;
10) successfully completed modules;
11) technical events;
12) actions in the profile;
13) licence history;
14) used device and browser;
15) maintenance information;
16) termination or renewal data.
15.2.
Those data shall be processed for the provision of agreed access, licence control, security, technical support and proof of performance.
16. Data from 5S, audit and organisational modules
16.1.
When company features are used, the following may be processed:
1) name of organisation;
2) facility name;
3) production area;
4) Department;
5) place of work;
6) name or identifier of an auditor;
7) name or identifier of a responsible person;
8) audit result;
9) findings;
10) corrective actions;
11) time limits;
12) comments;
13) photos;
14) attachments;
15) history of changes;
16) Statuses;
17) date and time;
18) Signature or electronic confirmation;
19) other information introduced by the corporate client.
16.2.
The corporate client determines what data are entered and is responsible for ensuring that the data are necessary and lawful.
16.3.
The Platform should not be used for covert surveillance, disproportionate monitoring or automated employee assessment without an appropriate legal basis and transparency.
16.4.
Where an audit or report can be prepared without an employee’s full name, the corporate client should use less identifying information.
17. Photos, images and media files
17.1.
Users can upload photos and other files for:
1) 5S audits;
2) proof of a condition before and after action;
3) documenting discrepancies;
4) instructions;
5) training;
6) claims;
7) technical support;
8) other permitted purposes.
17.2.
Photos may contain personal data when showing:
1) a person;
2) an employee identification card;
3) a name plate;
4) Signature;
5) registration number;
6) document;
7) computer screen;
8) working schedule;
9) other identifying information.
17.3.
The user and the corporate client should:
1) avoid photographing people where this is unnecessary;
2) avoid uploading identity documents;
3) conceal unrelated personal data;
4) use blurring or cropping where appropriate;
5) inform the persons concerned;
6) have a valid legal basis;
7) limit access to photos.
17.4.
Audit photos shall not be used for public marketing without a separate applicable legal basis.
18. Data on trainings and events
18.1.
When registering for and participating in training, we may process:
1) name;
2) email address;
3) telephone;
4) organisation;
5) position;
6) selected training;
7) date and format;
8) Payment status;
9) attendance;
10) participation;
11) progress;
12) completed assignments;
13) test results;
14) feedback received;
15) communication with the trainer;
16) technical details for joining;
17) preferred language;
18) necessary information for a certificate;
19) data for cancellation or transfer of participation;
20) other data needed to provide training.
18.2.
Where training is conducted through an external platform for video conferences or e-learning, the necessary data may be provided to the supplier concerned.
18.3.
Where training is recorded, participants shall be informed in advance of:
1) the fact of the recording;
2) the objective;
3) scope;
4) the storage period;
5) persons who will have access;
6) how to exercise rights.
18.4.
A recording is not used for advertising merely because the individual participated in the training.
18.5.
Use of an individual’s image, voice, name or statement in public advertising content requires a separate, appropriate legal basis.
19. Certificate details
19.1.
To issue and verify a certificate, we can process:
1) name and surname;
2) name of the training;
3) date of the training;
4) result;
5) date of issue;
6) unique number;
7) organisation;
8) level or type of certificate;
9) information on validity;
10) information on withdrawal or correction;
11) other data required for verification.
19.2.
Public verification of a certificate where it is offered should only show the necessary information.
19.3.
Full results, personal contact details and other unnecessary information are not published through public verification.
20. Communication and service data
20.1.
When you contact us, we may process:
1) name;
2) email address;
3) telephone;
4) organisation;
5) content of the message;
6) attachments;
7) history of correspondence;
8) date and time;
9) channel used;
10) order number;
11) technical information;
12) actions taken on the request;
13) Internal notes necessary for the service.
20.2.
A telephone call shall not be recorded unless the person has been informed in advance and there is a valid legal basis.
21. Data relating to withdrawals, returns, product complaints and other complaints
21.1.
We can process:
1) name and contacts;
2) order number;
3) product or service concerned;
4) grounds for the request;
5) date of receipt or activation;
6) date of application;
7) unique number;
8) a waybill;
9) photos;
10) evidence;
11) correspondence;
12) the result of the verification;
13) a preferred solution;
14) banking data where necessary for refund;
15) amount and method of reimbursement;
16) status and history of processing;
17) other data needed to solve the case.
21.2.
Data are used to fulfil legal and contractual obligations, protect the parties’ rights, prevent fraud and maintain accounting records.
22. Technical data and logs
22.1.
When the Platform is used, the following may be processed automatically:
1) IP address;
2) date and time;
3) page visited;
4) requested Internet address;
5) type and browser version;
6) operating system;
7) type of device;
8) language settings;
9) session identifier;
10) referring page;
11) technical status or result codes;
12) error information;
13) sign-in and sign-out actions;
14) unsuccessful sign-in attempts;
15) changes of rights;
16) administrative actions;
17) downloads;
18) actions relating to orders;
19) consents given;
20) security information;
21) other technical events necessary to operate and protect the system.
22.2.
Technical logs shall be used for:
1) provision of the service;
2) identification of errors;
3) protection against unauthorised access;
4) prevention of fraud;
5) incident verification;
6) providing evidence of actions;
7) improving reliability;
8) fulfillment of legal obligations.
22.3.
The Merchant does not use technical logs for covert assessment of employees’ work performance.
23. Consent and preference data
23.1.
We can store evidence of:
1) acceptance of the Terms and Conditions;
2) the version of the accepted document;
3) consent to the immediate supply of digital content;
4) request for early start of a digital service;
5) marketing consent;
6) choice of cookies;
7) withdrawal of consent;
8) objection to marketing;
9) date and time;
10) technical identifier;
11) source and form;
12) the wording displayed when consent was given.
23.2.
Evidence that consent has been withdrawn may continue to be retained where necessary to demonstrate compliance with the law and prevent unwanted communications from resuming.
24. Special categories of personal data
24.1.
The Platform is not intended for systematic processing of special categories of personal data, including data concerning:
1) health status;
2) racial or ethnic origin;
3) religious or philosophical beliefs;
4) political views;
5) membership of a trade union organisation;
6) genetic data;
7) biometric data for unique identification;
8) sexual life or sexual orientation.
24.2.
Users shall not upload such data unless:
1) this is objectively necessary;
2) there is an applicable legal basis;
3) the additional requirements of the law are fulfilled;
4) the corporate client has authorised the processing;
5) appropriate protective measures have been applied.
24.3.
A photograph of a person is not automatically biometric data. It may become biometric data when processed using specific technical means for unique identification.
24.4.
The Merchant does not use facial recognition to identify users unless a separate, lawful feature is introduced and individuals are informed in advance.
25. Data relating to convictions and offences
25.1.
The Platform is not intended for systematic processing of data relating to convictions and offences.
25.2.
Such data must not be entered unless processing is expressly authorised by law and the necessary safeguards are applied.
26. Personal data sources
26.1.
We obtain personal data:
1) directly from the data subject;
2) from the person placing the order;
3) from the recipient of the consignment;
4) by a corporate client;
5) from an administrator of a company account;
6) from an authorised person;
7) from myPOS;
8) from banks and payment providers;
9) from Econt or another courier;
10) from a training or videoconferencing platform;
11) by email;
12) from technical systems and devices;
13) from cookies and similar technologies;
14) from a public source where it is lawful and necessary;
15) from a competent authority;
16) from another person entitled to provide the data.
26.2.
When a company administrator creates an account for a user, the data may be obtained from the organisation rather than directly from the individual.
26.3.
In that case, the necessary information about processing is provided at first contact, on first sign-in, within a reasonable period or through the company administrator, unless a legal exception applies.
27. Purposes of processing
27.1.
Personal data may be processed for:
1) providing and maintaining the website;
2) registration and management of profiles;
3) authentication and access management;
4) the conclusion and execution of contracts;
5) processing of orders;
6) acceptance and confirmation of payments;
7) supply of physical goods;
8) activation of digital content;
9) provision of digital services;
10) subscription management;
11) conducting trainings;
12) issue and verification of certificates;
13) provision of technical support;
14) communication with customers;
15) handling withdrawals and returns;
16) reviewing product complaints and other complaints;
17) refund of amounts;
18) invoicing and accounting;
19) the fulfilment of tax obligations;
20) prevention of fraud;
21) protection of profiles and systems;
22) management of consents;
23) sending contractual messages;
24) sending marketing messages where there is a legal basis;
25) analysis and improvement of the Platform;
26) developing new functionalities;
27) creation of anonymised statistics;
28) the exercise and protection of legal claims;
29) complying with requests from competent authorities;
30) fulfilling other legal obligations.
28. Legal bases
28.1. Contract and pre-contractual steps
We process data where necessary for:
1) registration at the user’s request;
2) preparing a quotation;
3) making an order;
4) payment;
5) delivery;
6) activation of access;
7) provision of digital content;
8) participation in training;
9) technical support;
10) processing of a contractual request;
11) fulfilling other contractual obligations.
28.2. Legal obligation
We process data where necessary for:
1) accounting;
(2) taxation;
3) issue and storage of invoices;
4) processing of consumer claims;
5) exercising the right of withdrawal;
6) protection of personal data;
7) response to competent authorities;
8) fulfilling other legal obligations.
28.3. Legitimate interests
We may process data for legitimate interests, such as:
1) protection of information systems;
2) prevention of fraud;
3) proof of contractual actions;
4) protection of legal claims;
5) improvement of services;
6) Business management;
7) internal reporting;
8) protection of property and rights;
9) Limited communication with business contacts;
10) preventing abuse;
11) anonymisation of information;
12) maintaining a minimal list of individuals who have objected to marketing.
28.4.
Before processing on the basis of legitimate interests, necessity, individuals’ expectations and the possible impact on their rights are assessed.
28.5. Consent
We can rely on consent for:
1) marketing newsletter;
2) optional cookies;
3) publication of a review;
4) use of image or voice for marketing;
5) participation in a voluntary survey;
6) another specific purpose for which consent is an appropriate legal basis.
28.6.
The consent may be withdrawn at any time.
28.7.
Withdrawal does not affect the lawfulness of processing carried out before it.
28.8.
Express consent to the immediate supply of digital content is a contractual consumer declaration and should not automatically be conflated with consent to marketing or other processing of personal data.
29. Mandatory and voluntary provision of data
29.1.
Some data are necessary to enter into or perform a contract.
29.2.
Without the necessary data, it may not be possible:
1) creating a profile;
2) processing of an order;
3) making or identifying payment;
4) delivery;
5) issue of an invoice;
6) activation of access;
7) participation in training;
8) issue of a certificate;
9) examination of a claim;
10) a refund.
29.3.
The data indicated as optional shall be provided voluntarily.
29.4.
Refusal of marketing consent does not prevent the making of a purchase.
29.5.
Rejecting optional analytics or marketing cookies should not prevent use of the core features.
30. Contractual and service messages
30.1.
We can send without separate marketing consent messages necessary for:
1) confirmation of registration;
2) confirmation of order;
3) payment;
4) delivery;
5) activation of access;
6) security;
7) change password;
8) expiry of the agreed access period;
9) training;
10) invoice;
11) withdrawal;
12) Return;
13) a claim;
14) technical support;
15) a change to a contracted service;
16) fulfillment of a legal obligation.
30.2.
Such communications shall not constitute marketing where their content is limited to the necessary contractual or service information.
31. Marketing messages
31.1.
Marketing messages may be sent:
1) upon valid consent;
(2) where another applicable legal basis so permits;
3) where an easy, free way to opt out is provided.
31.2.
The marketing message may contain:
1) news;
2) information about books;
3) information on training;
4) information on the platform;
5) promotional offers;
6) invitations to events;
7) useful professional content.
31.3.
The recipient may unsubscribe through:
1) link in the message;
2) profile settings;
3) e-mail to admin@leanchampionscommunity.com;
4) another provided mechanism.
31.4.
The objection to direct marketing shall be respected without undue delay.
31.5.
After an individual unsubscribes, we may retain minimal information on a suppression list to ensure they are not added again without a new legal basis.
32. Cookies and similar technologies
32.1.
The platform may use:
1) cookies;
2) local storage;
3) session identifiers;
4) pixels;
5) Similar technologies.
32.2.
The strictly necessary technologies may be used without consent where they are necessary for:
1) security;
2) signing in to an account;
3) basket;
4) maintain the selected session;
5) protection against abuse;
6) remembering privacy choices;
7) provision of an explicitly requested service.
32.3.
Analytics, functional or marketing technologies for which consent is required by law are activated only after a valid choice has been made.
32.4.
Details of the specific technologies, providers, purposes and durations are provided in the Cookies Policy and the consent management mechanism.
33. Anonymous and aggregated data
33.1.
We can create aggregated or anonymised statistics for:
1) number of visits;
2) used functionalities;
3) purchases;
4) trainings;
5) technical performance;
6) improving the service;
7) Internal analysis.
33.2.
Where the data are actually and irreversibly anonymised, they do not represent personal data.
33.3.
Anonymised data may be retained for longer where they do not permit identification of a natural person.
34. Recipients of personal data
34.1.
Personal data may be provided to:
1) myPOS;
2) banks and payment providers;
3) Econt and other couriers;
4) hosting providers;
5) cloud infrastructure providers;
6) e-mail providers;
7) providers of information systems;
8) Developers and technical support;
9) backup and cybersecurity providers;
10) distance learning platforms;
11) Videoconference platforms;
12) certificate providers;
13) accountants;
14) auditors;
15) lawyers and legal consultants;
16) insurers;
17) partners involved in the implementation of training or service;
18) state and municipal authorities;
19) Courts;
20) control bodies and supervisory authorities;
21) law enforcement authorities;
22) a legal successor following a reorganisation or transfer of the business;
23) other persons where the data subject is informed or disclosure is required by law.
34.2.
Access is provided only to the extent necessary and according to the recipient’s role.
34.3.
Where a supplier processes data on behalf of the merchant, the relationship shall be settled by contract and appropriate instructions.
34.4.
The processor shall not use the data for incompatible own purposes.
34.5.
Where a recipient acts as an independent controller, it is responsible for its own processing.
35. Corporate administrators
35.1.
A corporate administrator may have access to:
1) the names of the users in their organisation;
2) their business e-mail addresses;
3) roles;
4) access status;
5) the results of training;
6) company audits and reports;
7) customer content;
8) other information authorised by the corporate plan.
35.2.
The corporate administrator does not have access to:
1) complete card data;
2) personal passwords;
3) data from unrelated organisations;
4) other information beyond the rights granted to it.
35.3.
The organisation shall be responsible for granting admin rights only to appropriately authorised persons.
36. Transfers outside the European Economic Area
36.1.
We strive for personal data to be processed in the European Economic Area whenever reasonably possible.
36.2.
Some suppliers can process data in a country outside the European Economic Area.
36.3.
Such transfers take place only where an applicable mechanism is available, including:
1) a European Commission adequacy decision;
2) standard contractual clauses;
3) binding corporate rules;
4) an approved code of conduct or certification mechanism with commitments;
5) an express exception provided by law;
6) another permissible mechanism.
36.4.
Where standard contractual clauses are used, conditions in the recipient country may be assessed and supplementary measures applied where necessary.
36.5.
The data subject may request information about the applicable mechanism and how to obtain a copy of the relevant safeguards, insofar as this does not infringe third-party rights or security requirements.
37. Retention periods
37.1.
Personal data shall only be stored for the period necessary for that purpose, unless a longer period:
1) is required by law;
2) is necessary for the protection of legal claims;
3) is legally agreed;
4) is necessary for the conclusion of a dispute, verification or investigation.
37.2. User accounts
Data relating to an active account are retained for the period of registration and contractual access.
37.3.
After an account is closed, data in active systems are erased or restricted within a reasonable technical period, except for the portion necessary for:
1) contractual relationship;
2) accounting;
3) security;
4) proof of action;
5) Legal claims.
37.4.
Basic contractual and identification data may be retained until the applicable limitation periods expire, normally for up to five years after the relationship ends, unless a different period applies.
37.5. Corporate client content
The customer content shall be kept for the duration of the contract and under the agreed rules.
37.6.
Unless otherwise specifically agreed, a reasonable period for exporting content may be provided after termination, after which the content is erased or anonymised in active systems, except where retention is required by law.
37.7. Orders and contracts
Order and contract data are retained for the period of performance and the applicable limitation period.
37.8.
Where data are part of accounting information, they may be kept for the legally established accounting period.
37.9. Accounting documents
Accounting registers, financial statements and documents for tax control, audits and subsequent financial inspections are retained for the applicable statutory period, normally 10 years, calculated in accordance with the Accounting Act.
37.10. Unpaid and cancelled orders
Data on unpaid or cancelled orders may be stored for up to six months, except where necessary for the prevention of fraud, legal dispute or legal obligation.
37.11. Abandoned basket
Information about an unfinished basket may be retained for up to 30 days unless the user has saved it through their account or provided a separate basis for longer use.
37.12. Enquiries
Enquiries that do not lead to a contract may be retained for up to two years after the last substantive communication.
37.13. Withdrawals, returns and product complaints
Data relating to withdrawals, returns, product complaints and other complaints may be retained for up to five years after the case is closed.
37.14.
Documents representing accounting information shall be kept for the relevant longer legal period.
37.15. Trainings
Data relating to participation, attendance, progress and results may be retained for up to five years after training ends, unless the specific programme or the law requires a different period.
37.16. Certificates
Basic information needed to verify an issued certificate may be retained for up to 10 years or for the certificate’s period of validity, where necessary to verify authenticity.
37.17. Marketing
Marketing data are retained until consent is withdrawn, an objection is made, the legal basis ceases to apply or prolonged inactivity is identified.
37.18.
A minimal record of a marketing opt-out may be retained for as long as necessary to respect the objection.
37.19. Evidence of consent
Consent records may be retained for up to five years after withdrawal or termination of the relevant activity, where necessary to demonstrate lawfulness.
37.20. Technical Logs
Ordinary technical and security logs may be retained for up to 12 months.
37.21.
Logs relating to an incident, fraud, dispute or breach may be retained until the matter is finally resolved and the applicable period for claims has expired.
37.22. Cookies
The duration of each cookie is specified in the Cookies Policy or the consent management mechanism.
37.23. Backups
Data erased from active systems may remain temporarily in protected backups until the backup retention cycle expires.
37.24.
Backups are not used for ordinary active processing and are restored only where necessary for system recovery, security or a legal obligation.
37.25. Legal claims
Where there is a dispute, inspection or legal proceeding, the relevant data may be retained until the matter is finally resolved and the subsequent period for legal protection has expired.
38. Erasure, restriction and anonymisation
38.1.
After the applicable period has expired, personal data are:
1) erased;
2) destroyed;
3) irreversibly anonymised;
4) restricted where temporary retention is required by law or a dispute.
38.2.
Where the data must be preserved by law, they shall not be used for an incompatible new purpose.
38.3.
Erasure from all backups may take place gradually during their normal rotation.
38.4.
When a backup is restored, procedures may be applied to erase again data that were previously lawfully erased.
39. Technical and organisational measures
39.1.
The merchant shall apply appropriate measures taking into account the risk, nature, scope, context and purposes of the processing.
39.2.
The measures may include:
1) access control;
2) individual user profiles;
3) roles and permissions;
4) cryptographic password protection;
5) protected transmission of information;
6) registration of administrative actions;
7) backups;
8) protection against unauthorised access;
9) updating systems;
10) vulnerability management;
11) limiting unsuccessful sign-in attempts;
12) protection of the payment process;
13) separation of environments;
14) incident procedures;
15) contractual confidentiality obligations;
16) training of persons with access;
17) a periodic review of rights;
18) Minimization of data;
19) pseudonymisation, where appropriate;
20) physical protection of infrastructure;
21) other measures as technology develops.
39.3.
Access is limited to individuals who need it for their work or contractual duties.
39.4.
The provision of specific details of the protection may be restricted where disclosure would create a security risk.
39.5.
No system can guarantee absolute protection against all possible risks.
39.6.
This does not release the Merchant from the obligation to apply appropriate measures and respond to incidents.
40. Users’ security responsibilities
40.1.
The user should:
1) use a strong and unique password;
2) not share their password;
3) not allow unauthorised people to use their account;
4) sign out of their account on a shared device;
5) keep their device and browser up to date;
6) not open suspicious links;
7) report suspected compromise;
8) check the website address;
9) not send payment codes or passwords;
10) respect access permissions in the corporate account.
40.2.
If unauthorised access is suspected, the user should immediately change their password and contact the Merchant.
41. Security breaches
41.1.
When a breach is identified, the Merchant assesses:
1) the nature of the data;
(2) the number of persons concerned;
3) the possible consequences;
4) the likelihood of harm;
5) the protective measures taken.
41.2.
Where required by law, the supervisory authority is notified without undue delay and, where possible, within 72 hours of becoming aware of the breach.
41.3.
Where the breach may result in a high risk to individuals’ rights and freedoms, affected individuals are notified without undue delay, unless a legal exception applies.
41.4.
The notification may contain:
1) the nature of the breach;
(2) the possible consequences;
3) the measures taken;
4) recommendations to the person;
5) contact for further information.
42. Automated decision-making and profiling
42.1.
Unless the individual is expressly informed in a separate notice, the Merchant does not make decisions based solely on automated processing that produce legal effects or similarly significantly affect the individual.
42.2.
Automatic rules may be used for:
1) protection against spam;
2) detecting unusual sign-in attempts;
3) verification of technical validity;
4) calculation of price and delivery;
5) activation after successful payment;
6) display content according to the purchased plan;
7) other routine operations without significant legal impact.
42.3.
If automated decision-making with a significant impact is introduced, information will be provided about:
1) logic;
2) its significance;
3) the possible consequences;
4) the right to human intervention;
5) the right to express an opinion;
6) the right to challenge the decision.
43. Right to information
43.1.
The data subject has the right to receive clear, understandable information about processing.
43.2.
The information shall be provided by:
1) the current policy;
2) Cookies Policy;
3) notifications upon registration;
4) information on ordering;
5) contracts;
6) Special notifications;
7) response to an individual request.
44. Right of access
44.1.
The data subject may request confirmation of whether their personal data are being processed.
44.2.
Where data are processed, the data subject may request:
1) a copy of the data;
2) the purposes;
3) categories of data;
4) recipients;
5) the retention period or criteria;
6) the source;
7) information on rights;
8) information about international transfers;
9) information about automated decisions, where applicable.
44.3.
The right to a copy shall not adversely affect the rights and freedoms of others.
45. Right to rectification
45.1.
The data subject may request correction of inaccurate personal data.
45.2.
Taking the purpose into account, the data subject may request completion of incomplete data.
45.3.
Some data can be corrected directly through the profile.
46. Right to erasure
46.1.
The data subject may request erasure where:
1) the data are no longer necessary;
2) consent has been withdrawn and there is no other legal basis;
3) a justified objection has been made;
4) the data were processed illegally;
5) the deletion is required by law;
6) another ground under the GDPR applies.
46.2.
The right to erasure is not absolute.
46.3.
Data may be retained where necessary for:
1) fulfilling a legal obligation;
(2) exercising the right to freedom of expression and information;
3) public interest;
4) archival, scientific or statistical purposes under the applicable conditions;
5) establishment, exercise or defence of legal claims;
6) another legal basis.
46.4.
Deleting an account does not automatically erase invoices, contractual records or other data that must be retained.
47. Right to restriction of processing
47.1.
The data subject may request restriction where:
1) they contest the accuracy of the data;
2) processing is unlawful but they do not want erasure;
3) the Merchant no longer needs the data, but the data are needed for a legal claim;
4) an objection has been submitted and is being examined.
47.2.
Where processing is restricted, the data are normally retained but are not used for other activities without an applicable legal basis.
48. Right to data portability
48.1.
Where processing is automated and based on consent or a contract, the data subject may have the right to receive the data they provided in a structured, commonly used, machine-readable format.
48.2.
Where technically possible, the individual may request that the data be transmitted directly to another controller.
48.3.
The right to portability does not apply to all data and must not adversely affect third-party rights.
49. Right to object
49.1.
The data subject may object to processing based on legitimate interests for reasons relating to their particular situation.
49.2.
Following an objection, processing stops unless the Merchant demonstrates overriding compelling legitimate grounds or the data are necessary for legal claims.
49.3.
An objection to direct marketing is respected without requiring the individual to provide a specific reason.
50. Right to withdraw consent
50.1.
Where the processing is based on consent, it may be withdrawn at any time.
50.2.
Withdrawing consent must be as easy as giving it.
50.3.
Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
50.4.
Withdrawing marketing consent does not stop contractual messages.
51. Rights relating to automated decisions
51.1.
Where applicable, the data subject has the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects them.
51.2.
Where an exception applies, the individual may have the right to:
1) human intervention;
2) expression of a view;
3) contesting the decision.
52. Exercise of the rights
52.1.
A request may be submitted to:
LEAN BULGARIA OOD
Email: admin@leanchampionscommunity.com
Address: Sofia, 55 Kiril Popov Street, entrance A, floor 1, apartment 4, Republic of Bulgaria
52.2.
The recommended email subject line is:
“Personal data request”
52.3.
The request should contain:
1) name;
2) way of contact;
3) a description of the action requested;
4) information allowing the account or relationship to be identified;
5) the preferred way to receive a response.
52.4.
The individual is not required to identify a specific article of the GDPR.
52.5.
Where the Merchant acts as a processor, the request may be forwarded to the relevant corporate controller.
53. Identity check
53.1.
Where there are reasonable doubts about identity, additional information may be requested.
53.2.
The verification shall be:
1) necessary;
2) proportionate;
3) appropriate to the risk;
4) limited to minimum information.
53.3.
A copy of an identity document is not required by default.
53.4.
Where possible, less intrusive methods are used, such as:
1) confirmation from the registered e-mail address;
2) login to the profile;
3) order number;
4) limited verification of known data;
5) another secure method.
54. Response deadline
54.1.
The Merchant responds without undue delay and, as a rule, within one month of receiving the request.
54.2.
Where requests are complex or numerous, the period may be extended by a further two months.
54.3.
The individual is informed of the extension and the reasons within one month of receipt of the request.
54.4.
Where no action is taken, the individual is informed of the reasons and of the option to lodge a complaint or seek a judicial remedy.
55. Fees
55.1.
As a rule, exercising these rights is free of charge.
55.2.
Where a request is manifestly unfounded or excessive, particularly because it is repetitive, the Merchant may:
1) charge a reasonable fee reflecting the administrative costs;
2) refuse to take action.
55.3.
The Merchant is responsible for demonstrating that a request is manifestly unfounded or excessive.
56. Right to lodge a complaint with a supervisory authority
56.1.
The data subject has the right to lodge a complaint with the Commission for Personal Data Protection if they consider that processing infringes applicable legislation.
56.2.
Contact details of the Commission for Personal Data Protection:
Address: 2 Prof. Tsvetan Lazarov Boulevard, Sofia 1592, Republic of Bulgaria
E-mail: kzld@cpdp.bg
Website: cpdp.bg
56.3.
The right to lodge a complaint does not depend on a mandatory prior request to the Merchant.
56.4.
The data subject also has the right to an effective judicial remedy.
57. Children’s data
57.1.
The Platform is intended primarily for adults, professionals, organisations and individuals who can validly enter into a contract.
57.2.
We do not knowingly collect children’s personal data for marketing without an appropriate legal basis.
57.3.
Where processing of data relating to a person under 14 is based on consent in connection with the direct offer of an information society service, consent must be given or authorised by a parent or guardian under applicable Bulgarian law.
57.4.
Where training or another service is intended for minors, separate, appropriate information is provided and the necessary measures are taken.
57.5.
If children’s data are found to have been collected without the necessary legal basis, they are erased or the processing is brought into compliance without undue delay.
58. External links and services
58.1.
The platform may contain links to external websites and services.
58.2.
The merchant shall not determine how an independent external controller processes the data after visiting its page.
58.3.
The user should read the privacy policy of the relevant external service.
58.4.
Where an external service is embedded in the Platform, the necessary information is provided and consent obtained in accordance with applicable law.
59. Social networks
59.1.
When a person interacts with a Lean Champions profile on a social network, the social network operator can also process data as an independent controller.
59.2.
We can get information that the person:
1) has made public;
2) sent by personal message;
3) has submitted by comment;
4) has shared through a function of the social network.
59.3.
Data are not automatically added to a marketing list without an applicable legal basis.
60. Policy changes
60.1.
The Policy may be updated following:
1) change of legislation;
2) change of services;
3) introducing a new method of payment;
4) adding a new module;
5) change of suppliers;
6) changing storage times;
7) a change to international transfers;
8) development of security measures;
9) another objective reason.
60.2.
The current version is published with a version number, effective date and date of the latest update.
60.3.
Where a change is material, affected individuals may be informed through:
1) email;
2) message in the profile;
3) notice on the website;
4) another suitable channel.
60.4.
Where consent is required for a new purpose, updating the Policy does not itself replace that consent.
60.5.
Previous versions may be archived as evidence of the information provided.
61. Contacts
61.1.
In the case of questions, requests or complaints concerning personal data, you may contact:
LEAN BULGARIA OOD
Unified Identification Code (UIC): 203317933
VAT identification number: BG203317933
Address: Sofia, 55 Kiril Popov Street, entrance A, floor 1, apartment 4, Republic of Bulgaria
Email: admin@leanchampionscommunity.com
Telephone: +359 896 060 911
Website: leanchampionscommunity.com
61.2.
For faster processing, specify:
1) your name;
2) the e-mail address used;
3) the organisation, where applicable;
4) the order or account number, where known;
5) a clear description of the request;
6) a preferred contact method.
61.3.
Do not send by email:
1) full bank card number;
2) security code;
3) password;
4) a two-factor authentication code;
5) other unnecessary authentication credentials.
62. Entry into force
62.1.
This Privacy Policy takes effect on the date stated in the ‘Effective from’ field.
62.2.
This version applies to processing from its effective date.
62.3.
Where specific processing is governed by a separate contract, specific notice or personal data processing agreement, those documents apply together with this Policy.
62.4.
Where a provision of this Policy conflicts with a mandatory legal rule, that rule applies without affecting the rest of the Policy.
1. Purpose and scope
1.1.
This Privacy Policy governs the way that LEAN BULGARIA OOD collects, receives, uses, stores, organizes, changes, provides, restricts, deletes and otherwise processes personal data in relation to Lean Champions Platform, Lean Champions Store and related products, services and functionalities.
1.2.
The policy shall apply to:
1) visiting and using the website leanchampionscommunity.com;
2) creating and using a user profile;
3) use of an individual, team or corporate profile;
4) placing and fulfilling orders;
5) purchase and delivery of physical goods;
6) purchase and supply of digital content;
7) activation and use of digital services;
8) purchase and use of subscription access;
9) participation in distance, online or in-person training;
10) participation in webinars, seminars, events and consultations;
11) use of 5S, audit, reporting, training and other Platform modules;
12) submitting an enquiry, notice of withdrawal, return request, product complaint, other complaint or other request;
13) making payment through myPOS, bank transfer, cash on delivery or other active method;
14) communication with the merchant;
15) receiving contractual, informational or marketing messages;
16) use of cookies and similar technologies;
17) ensuring the security and proper functioning of the Platform.
1.3.
The policy shall apply to the personal data of:
1) visitors to the website;
2) registered users;
3) clients and recipients of orders;
4) participants in training;
5) representatives, employees and contact persons of corporate clients;
6) administrators of company profiles;
7) persons included in uploaded material, photos, audits, reports or other records;
8) persons associated with the merchant;
9) persons exercising rights under the legislation on the protection of personal data;
10) other natural persons whose data are lawfully processed through the Platform.
1.4.
Data concerning legal persons shall not constitute personal data unless the information identifies or may be related to a specific natural person, such as a manager, employee, representative or contact person.
1.5.
This Policy provides information under Regulation (EU) 2016/679, referred to below as the ‘GDPR’, the Personal Data Protection Act and other applicable legislation.
1.6.
Reading this Privacy Policy does not constitute consent to all the processing activities described.
1.7.
Where processing requires consent, it is requested separately, for a specific purpose, through a clear affirmative action and without a pre-ticked box.
1.8.
The policy shall apply together with:
1) the Terms and Conditions;
2) Cookies Policy;
3) Delivery and payment policy;
4) The policy on the right of withdrawal;
5) Return policy;
6) The complaint policy;
7) the conditions of the particular product or service;
8) the additional notifications shown in individual functionalities;
9) personal data processing contracts with corporate clients where applicable.
2. Data controller
2.1.
The controller responsible for processing personal data for its own purposes in connection with Lean Champions Platform and Lean Champions Store is:
LEAN BULGARIA OOD
Unified Identification Code (UIC): 203317933
VAT identification number: BG203317933
Registered office and management address: Sofia, 55 Kiril Popov Street, entrance A, floor 1, apartment 4, Republic of Bulgaria
Manager: Todor Neychev
Email: admin@leanchampionscommunity.com
Telephone: +359 896 060 911
Website: leanchampionscommunity.com
referred to below as the ‘Merchant’, the ‘Controller’, ‘we’, ‘us’ or ‘our’.
2.2.
For questions about personal data protection, the subject line of your email may state:
Personal data.
2.3.
The Merchant determines the purposes and means of processing personal data when acting as a controller.
2.4.
When processing data on behalf of a corporate client and solely on its documented instructions, the Merchant may act as a processor.
3. Basic concepts
3.1.
“Personal data” means any information relating to an identified or identifiable natural person.
3.2.
The data subject is the natural person to whom the personal data relate.
3.3.
“Processing” means any operation or set of operations on personal data, including collection, recording, organisation, structuring, storage, alteration, retrieval, consultation, use, disclosure, restriction, erasure or destruction.
3.4.
“Controller” means the person who determines the purposes and means of processing.
3.5.
The processor is the person who processes personal data on behalf of the controller.
3.6.
“Recipient” means a person, organisation or authority to which personal data are disclosed.
3.7.
“Consent” means a freely given, specific, informed and unambiguous indication of the data subject’s wishes.
3.8.
“Pseudonymisation” means processing that prevents data from being attributed to a specific person without additional information kept separately.
3.9.
‘Anonymised data’ means data that cannot reasonably be linked to a specific natural person.
3.10.
A ‘personal data breach’ is a breach leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.
3.11.
"Corporate client" is an organisation that buys or manages access to the Platform for its employees, representatives, counterparties or other authorised users.
3.12.
‘Client content’ means the information, documents, photographs, recordings, audits, reports, tasks, comments and other data entered or uploaded by a client or its users.
4. Roles in Processing
4.1.
The Merchant acts as an independent controller for data processed for:
1) website management;
2) registration and management of user profiles;
3) conclusion and execution of contracts;
4) processing of orders;
5) payments and accounting;
6) supply of physical goods;
7) provision of digital content and digital services;
8) conducting training;
9) customer service;
10) handling withdrawals, returns and product complaints;
11) security protection;
12) prevention of fraud;
13) the fulfilment of legal obligations;
14) protection of legal claims;
15) own marketing communication.
4.2.
The corporate client normally acts as a controller for personal data that it or its users enter into the Platform for its own organisational purposes, including data concerning:
1) employees;
(2) operators;
3) managers;
4) auditors;
5) participants in 5S checks;
6) persons responsible for corrective actions;
7) participants in training;
8) internal users;
9) other persons designated by the corporate client.
4.3.
When processing client content on the documented instructions of the corporate client, the Merchant may act as a processor.
4.4.
The relationship between the corporate client and the Merchant may be further governed by a personal data processing agreement or addendum.
4.5.
The corporate client shall be responsible for:
1) having a valid legal basis for the data entered;
2) providing the necessary information to the individuals concerned;
3) entering only data necessary for its lawful purposes;
4) assigning appropriate access rights;
5) updating and correcting inaccurate data;
6) not using the Platform for unlawful surveillance;
7) not uploading unnecessary special categories of data;
8) giving lawful instructions to the Merchant.
4.6.
Where a data subject submits a request about data for which the corporate client is the controller, the Merchant may:
1) forward the request to the corporate client;
2) inform the individual who the relevant controller is;
3) assist the corporate client within the scope of its contractual and legal obligations.
4.7.
The Merchant does not independently determine the purposes for which the corporate client uses the internal data it uploads, except for the Merchant’s own security, maintenance, invoicing and legal compliance purposes.
5. Processing principles
5.1.
Personal data shall be processed in accordance with the following principles:
1) lawfulness;
2) fairness;
3) transparency;
4) purpose limitation;
5) data minimisation;
6) accuracy;
7) storage limitation;
8) integrity;
9) confidentiality;
10) accountability.
5.2.
The Merchant aims to process only personal data that are adequate, relevant and limited to what is necessary for the specific purpose.
5.3.
The Merchant takes reasonable steps to correct or erase inaccurate data when informed of the inaccuracy.
5.4.
Personal data are not used for a new, incompatible purpose without an additional legal basis and the necessary information being provided to the data subject.
6. Categories of data subjects
6.1.
We may process personal data relating to:
1) visitors to the Platform;
2) customers;
3) recipients of consignments;
4) payers;
5) bank account holders;
6) registered users;
7) Profile administrators;
8) representatives of legal entities;
9) employees and associates of corporate clients;
10) participants in trainings and events;
11) trainers and lecturers;
12) persons making inquiries;
13) persons applying for withdrawal;
14) persons making claims;
15) individuals included in user content;
16) visitors, whether or not they refused to consent to cookies;
17) individuals who have subscribed to marketing communications;
18) persons for whom we are obliged to process data under law.
7. Identification data
7.1.
Depending on the service used, we can process:
1) name;
2) last name;
3) username;
4) internal profile identifier;
5) client number;
6) participant number;
7) certificate number;
8) a signature, where required for a paper document;
9) a position;
10) organisation;
11) Department;
12) professional role;
13) a work identifier, where entered by a corporate client;
14) other identification information necessary for the specific service.
7.2.
As a rule, we do not require a Bulgarian personal identification number (EGN), identity card number or copy of an identity document for ordinary registration or an order.
7.3.
An identity document may be requested only where lawful, necessary and proportionate, for example to verify identity in relation to a specific request or to prevent fraud.
7.4.
Where this is sufficient, unnecessary data in the document must be redacted.
8. Contact details
8.1.
We can process:
1) e-mail address;
2) telephone number;
3) delivery address;
4) billing address;
5) address for correspondence;
6) Selected courier office;
7) locality;
8) postal code;
9) country;
10) business contact details;
11) Preferred communication channel.
9. User profile data
9.1.
When creating and using a profile we can process:
1) username;
2) email address;
3) a cryptographically protected representation of the password;
4) role and level of access;
5) organisation;
6) language settings;
7) Profile settings;
8) date of registration;
9) date of confirmation of the e-mail address;
10) date of last sign-in;
11) Profile status;
12) activated products and modules;
13) start and end of access;
14) number of authorised users;
15) History of changes in the profile;
16) information about invitations to other users;
17) used functions;
18) administrative actions;
19) information about the blocking, restoration or termination of access.
9.2.
Passwords are not stored as visible, readable text when the system is technically configured in accordance with the security measures applied.
9.3.
The Merchant never asks users to send their passwords by email.
10. Order details
10.1.
When performing an order we can process:
1) order number;
2) date and time;
3) selected products and services;
4) quantities;
5) unit and total prices;
6) applied discounts;
7) currency;
8) taxes;
9) delivery costs;
10) chosen method of payment;
11) Selected delivery method;
12) the status of the order;
13) history of changes;
14) contractual consents granted;
15) version of the accepted Terms and Conditions;
16) version of policies;
17) date and time of the explicit consents given;
18) activation information;
19) cancellation information;
20) refund information;
21) contractual correspondence;
22) other data necessary to implement and prove the contract.
11. Delivery data
11.1.
For delivery of physical goods we can process:
1) name of the recipient;
2) telephone;
(3) email address;
4) address;
5) Selected office of Econt;
6) Additional delivery instructions;
7) shipment tracking or waybill number;
8) value of the consignment;
9) cash-on-delivery amount;
10) details of the consignment’s contents to the extent necessary;
11) Delivery status;
12) date of dispatch;
13) date of receipt;
14) information on the consignment not received or returned;
15) damage reports;
16) communication with the courier;
17) other information required for the courier service.
11.2.
Data are provided to the courier only to the extent necessary for delivery, collection of cash-on-delivery payments, tracking and resolving problems.
12. Data on card payments through myPOS
12.1.
When payment is made by bank card through myPOS, the Merchant may receive and retain limited information, such as:
1) transaction identifier;
2) order number;
3) amount and currency;
4) date and time;
5) status of payment;
6) status of refund;
7) partially masked payment instrument data where provided;
8) type of card scheme;
9) code or description of the result;
10) information necessary to prevent fraud;
11) correspondence on payment;
12) details of disputes, refunds or payment reversals.
12.2.
The Merchant does not receive or store:
1) the full number of the bank card;
2) the security code;
3) the personal identification number;
4) password for banking application;
5) complete payment card authentication data.
12.3.
Full payment details are entered in the secure environment of myPOS or another designated, licensed payment service provider.
12.4.
myPOS may process personal data as an independent controller for the provision of the payment service, fraud prevention, regulatory obligations and other own legal purposes.
12.5.
Processing by myPOS is also governed by its own privacy information.
13. Bank transfer data
13.1.
When payment by bank transfer is activated, we may process:
1) name of the payer;
2) name of the account holder;
3) IBAN;
4) BIC;
5) Bank;
6) amount and currency of the transfer;
7) date of order and receipt;
8) reason for payment;
9) order number;
10) status of payment;
11) data on partial, overpaid or late payment;
12) refund information;
13) correspondence about the transfer.
13.2.
Bank data shall be used for:
1) identification of the payment;
2) connection to the order;
3) accounting;
4) refund of an amount;
5) preventing errors and fraud;
6) fulfillment of legal obligations.
13.3.
Banks and payment service providers also process data as independent controllers in accordance with their own legal obligations.
14. Invoicing and accounting data
14.1.
When issuing accounting documents, we can process:
1) name and surname;
2) name of organisation;
3) EIC or other registration number;
4) VAT identification number;
5) address;
6) name of the representing person;
7) contact person;
8) e-mail address;
9) order details;
10) payment details;
11) content and value of the invoice;
12) other details required by law.
14.2.
Information relating solely to a legal person is not personal data, but data relating to representatives, contact persons and natural persons are protected under this Policy.
15. Digital content and platform access data
15.1.
When providing digital content or digital service we can process:
1) purchased product;
2) activated plan;
3) activated modules;
4) date and time of activation;
5) start and end dates;
6) number of authorised users;
7) downloads;
8) access to materials;
9) progress;
10) successfully completed modules;
11) technical events;
12) actions in the profile;
13) licence history;
14) used device and browser;
15) maintenance information;
16) termination or renewal data.
15.2.
Those data shall be processed for the provision of agreed access, licence control, security, technical support and proof of performance.
16. Data from 5S, audit and organisational modules
16.1.
When company features are used, the following may be processed:
1) name of organisation;
2) facility name;
3) production area;
4) Department;
5) place of work;
6) name or identifier of an auditor;
7) name or identifier of a responsible person;
8) audit result;
9) findings;
10) corrective actions;
11) time limits;
12) comments;
13) photos;
14) attachments;
15) history of changes;
16) Statuses;
17) date and time;
18) Signature or electronic confirmation;
19) other information introduced by the corporate client.
16.2.
The corporate client determines what data are entered and is responsible for ensuring that the data are necessary and lawful.
16.3.
The Platform should not be used for covert surveillance, disproportionate monitoring or automated employee assessment without an appropriate legal basis and transparency.
16.4.
Where an audit or report can be prepared without an employee’s full name, the corporate client should use less identifying information.
17. Photos, images and media files
17.1.
Users can upload photos and other files for:
1) 5S audits;
2) proof of a condition before and after action;
3) documenting discrepancies;
4) instructions;
5) training;
6) claims;
7) technical support;
8) other permitted purposes.
17.2.
Photos may contain personal data when showing:
1) a person;
2) an employee identification card;
3) a name plate;
4) Signature;
5) registration number;
6) document;
7) computer screen;
8) working schedule;
9) other identifying information.
17.3.
The user and the corporate client should:
1) avoid photographing people where this is unnecessary;
2) avoid uploading identity documents;
3) conceal unrelated personal data;
4) use blurring or cropping where appropriate;
5) inform the persons concerned;
6) have a valid legal basis;
7) limit access to photos.
17.4.
Audit photos shall not be used for public marketing without a separate applicable legal basis.
18. Data on trainings and events
18.1.
When registering for and participating in training, we may process:
1) name;
2) email address;
3) telephone;
4) organisation;
5) position;
6) selected training;
7) date and format;
8) Payment status;
9) attendance;
10) participation;
11) progress;
12) completed assignments;
13) test results;
14) feedback received;
15) communication with the trainer;
16) technical details for joining;
17) preferred language;
18) necessary information for a certificate;
19) data for cancellation or transfer of participation;
20) other data needed to provide training.
18.2.
Where training is conducted through an external platform for video conferences or e-learning, the necessary data may be provided to the supplier concerned.
18.3.
Where training is recorded, participants shall be informed in advance of:
1) the fact of the recording;
2) the objective;
3) scope;
4) the storage period;
5) persons who will have access;
6) how to exercise rights.
18.4.
A recording is not used for advertising merely because the individual participated in the training.
18.5.
Use of an individual’s image, voice, name or statement in public advertising content requires a separate, appropriate legal basis.
19. Certificate details
19.1.
To issue and verify a certificate, we can process:
1) name and surname;
2) name of the training;
3) date of the training;
4) result;
5) date of issue;
6) unique number;
7) organisation;
8) level or type of certificate;
9) information on validity;
10) information on withdrawal or correction;
11) other data required for verification.
19.2.
Public verification of a certificate where it is offered should only show the necessary information.
19.3.
Full results, personal contact details and other unnecessary information are not published through public verification.
20. Communication and service data
20.1.
When you contact us, we may process:
1) name;
2) email address;
3) telephone;
4) organisation;
5) content of the message;
6) attachments;
7) history of correspondence;
8) date and time;
9) channel used;
10) order number;
11) technical information;
12) actions taken on the request;
13) Internal notes necessary for the service.
20.2.
A telephone call shall not be recorded unless the person has been informed in advance and there is a valid legal basis.
21. Data relating to withdrawals, returns, product complaints and other complaints
21.1.
We can process:
1) name and contacts;
2) order number;
3) product or service concerned;
4) grounds for the request;
5) date of receipt or activation;
6) date of application;
7) unique number;
8) a waybill;
9) photos;
10) evidence;
11) correspondence;
12) the result of the verification;
13) a preferred solution;
14) banking data where necessary for refund;
15) amount and method of reimbursement;
16) status and history of processing;
17) other data needed to solve the case.
21.2.
Data are used to fulfil legal and contractual obligations, protect the parties’ rights, prevent fraud and maintain accounting records.
22. Technical data and logs
22.1.
When the Platform is used, the following may be processed automatically:
1) IP address;
2) date and time;
3) page visited;
4) requested Internet address;
5) type and browser version;
6) operating system;
7) type of device;
8) language settings;
9) session identifier;
10) referring page;
11) technical status or result codes;
12) error information;
13) sign-in and sign-out actions;
14) unsuccessful sign-in attempts;
15) changes of rights;
16) administrative actions;
17) downloads;
18) actions relating to orders;
19) consents given;
20) security information;
21) other technical events necessary to operate and protect the system.
22.2.
Technical logs shall be used for:
1) provision of the service;
2) identification of errors;
3) protection against unauthorised access;
4) prevention of fraud;
5) incident verification;
6) providing evidence of actions;
7) improving reliability;
8) fulfillment of legal obligations.
22.3.
The Merchant does not use technical logs for covert assessment of employees’ work performance.
23. Consent and preference data
23.1.
We can store evidence of:
1) acceptance of the Terms and Conditions;
2) the version of the accepted document;
3) consent to the immediate supply of digital content;
4) request for early start of a digital service;
5) marketing consent;
6) choice of cookies;
7) withdrawal of consent;
8) objection to marketing;
9) date and time;
10) technical identifier;
11) source and form;
12) the wording displayed when consent was given.
23.2.
Evidence that consent has been withdrawn may continue to be retained where necessary to demonstrate compliance with the law and prevent unwanted communications from resuming.
24. Special categories of personal data
24.1.
The Platform is not intended for systematic processing of special categories of personal data, including data concerning:
1) health status;
2) racial or ethnic origin;
3) religious or philosophical beliefs;
4) political views;
5) membership of a trade union organisation;
6) genetic data;
7) biometric data for unique identification;
8) sexual life or sexual orientation.
24.2.
Users shall not upload such data unless:
1) this is objectively necessary;
2) there is an applicable legal basis;
3) the additional requirements of the law are fulfilled;
4) the corporate client has authorised the processing;
5) appropriate protective measures have been applied.
24.3.
A photograph of a person is not automatically biometric data. It may become biometric data when processed using specific technical means for unique identification.
24.4.
The Merchant does not use facial recognition to identify users unless a separate, lawful feature is introduced and individuals are informed in advance.
25. Data relating to convictions and offences
25.1.
The Platform is not intended for systematic processing of data relating to convictions and offences.
25.2.
Such data must not be entered unless processing is expressly authorised by law and the necessary safeguards are applied.
26. Personal data sources
26.1.
We obtain personal data:
1) directly from the data subject;
2) from the person placing the order;
3) from the recipient of the consignment;
4) by a corporate client;
5) from an administrator of a company account;
6) from an authorised person;
7) from myPOS;
8) from banks and payment providers;
9) from Econt or another courier;
10) from a training or videoconferencing platform;
11) by email;
12) from technical systems and devices;
13) from cookies and similar technologies;
14) from a public source where it is lawful and necessary;
15) from a competent authority;
16) from another person entitled to provide the data.
26.2.
When a company administrator creates an account for a user, the data may be obtained from the organisation rather than directly from the individual.
26.3.
In that case, the necessary information about processing is provided at first contact, on first sign-in, within a reasonable period or through the company administrator, unless a legal exception applies.
27. Purposes of processing
27.1.
Personal data may be processed for:
1) providing and maintaining the website;
2) registration and management of profiles;
3) authentication and access management;
4) the conclusion and execution of contracts;
5) processing of orders;
6) acceptance and confirmation of payments;
7) supply of physical goods;
8) activation of digital content;
9) provision of digital services;
10) subscription management;
11) conducting trainings;
12) issue and verification of certificates;
13) provision of technical support;
14) communication with customers;
15) handling withdrawals and returns;
16) reviewing product complaints and other complaints;
17) refund of amounts;
18) invoicing and accounting;
19) the fulfilment of tax obligations;
20) prevention of fraud;
21) protection of profiles and systems;
22) management of consents;
23) sending contractual messages;
24) sending marketing messages where there is a legal basis;
25) analysis and improvement of the Platform;
26) developing new functionalities;
27) creation of anonymised statistics;
28) the exercise and protection of legal claims;
29) complying with requests from competent authorities;
30) fulfilling other legal obligations.
28. Legal bases
28.1. Contract and pre-contractual steps
We process data where necessary for:
1) registration at the user’s request;
2) preparing a quotation;
3) making an order;
4) payment;
5) delivery;
6) activation of access;
7) provision of digital content;
8) participation in training;
9) technical support;
10) processing of a contractual request;
11) fulfilling other contractual obligations.
28.2. Legal obligation
We process data where necessary for:
1) accounting;
(2) taxation;
3) issue and storage of invoices;
4) processing of consumer claims;
5) exercising the right of withdrawal;
6) protection of personal data;
7) response to competent authorities;
8) fulfilling other legal obligations.
28.3. Legitimate interests
We may process data for legitimate interests, such as:
1) protection of information systems;
2) prevention of fraud;
3) proof of contractual actions;
4) protection of legal claims;
5) improvement of services;
6) Business management;
7) internal reporting;
8) protection of property and rights;
9) Limited communication with business contacts;
10) preventing abuse;
11) anonymisation of information;
12) maintaining a minimal list of individuals who have objected to marketing.
28.4.
Before processing on the basis of legitimate interests, necessity, individuals’ expectations and the possible impact on their rights are assessed.
28.5. Consent
We can rely on consent for:
1) marketing newsletter;
2) optional cookies;
3) publication of a review;
4) use of image or voice for marketing;
5) participation in a voluntary survey;
6) another specific purpose for which consent is an appropriate legal basis.
28.6.
The consent may be withdrawn at any time.
28.7.
Withdrawal does not affect the lawfulness of processing carried out before it.
28.8.
Express consent to the immediate supply of digital content is a contractual consumer declaration and should not automatically be conflated with consent to marketing or other processing of personal data.
29. Mandatory and voluntary provision of data
29.1.
Some data are necessary to enter into or perform a contract.
29.2.
Without the necessary data, it may not be possible:
1) creating a profile;
2) processing of an order;
3) making or identifying payment;
4) delivery;
5) issue of an invoice;
6) activation of access;
7) participation in training;
8) issue of a certificate;
9) examination of a claim;
10) a refund.
29.3.
The data indicated as optional shall be provided voluntarily.
29.4.
Refusal of marketing consent does not prevent the making of a purchase.
29.5.
Rejecting optional analytics or marketing cookies should not prevent use of the core features.
30. Contractual and service messages
30.1.
We can send without separate marketing consent messages necessary for:
1) confirmation of registration;
2) confirmation of order;
3) payment;
4) delivery;
5) activation of access;
6) security;
7) change password;
8) expiry of the agreed access period;
9) training;
10) invoice;
11) withdrawal;
12) Return;
13) a claim;
14) technical support;
15) a change to a contracted service;
16) fulfillment of a legal obligation.
30.2.
Such communications shall not constitute marketing where their content is limited to the necessary contractual or service information.
31. Marketing messages
31.1.
Marketing messages may be sent:
1) upon valid consent;
(2) where another applicable legal basis so permits;
3) where an easy, free way to opt out is provided.
31.2.
The marketing message may contain:
1) news;
2) information about books;
3) information on training;
4) information on the platform;
5) promotional offers;
6) invitations to events;
7) useful professional content.
31.3.
The recipient may unsubscribe through:
1) link in the message;
2) profile settings;
3) e-mail to admin@leanchampionscommunity.com;
4) another provided mechanism.
31.4.
The objection to direct marketing shall be respected without undue delay.
31.5.
After an individual unsubscribes, we may retain minimal information on a suppression list to ensure they are not added again without a new legal basis.
32. Cookies and similar technologies
32.1.
The platform may use:
1) cookies;
2) local storage;
3) session identifiers;
4) pixels;
5) Similar technologies.
32.2.
The strictly necessary technologies may be used without consent where they are necessary for:
1) security;
2) signing in to an account;
3) basket;
4) maintain the selected session;
5) protection against abuse;
6) remembering privacy choices;
7) provision of an explicitly requested service.
32.3.
Analytics, functional or marketing technologies for which consent is required by law are activated only after a valid choice has been made.
32.4.
Details of the specific technologies, providers, purposes and durations are provided in the Cookies Policy and the consent management mechanism.
33. Anonymous and aggregated data
33.1.
We can create aggregated or anonymised statistics for:
1) number of visits;
2) used functionalities;
3) purchases;
4) trainings;
5) technical performance;
6) improving the service;
7) Internal analysis.
33.2.
Where the data are actually and irreversibly anonymised, they do not represent personal data.
33.3.
Anonymised data may be retained for longer where they do not permit identification of a natural person.
34. Recipients of personal data
34.1.
Personal data may be provided to:
1) myPOS;
2) banks and payment providers;
3) Econt and other couriers;
4) hosting providers;
5) cloud infrastructure providers;
6) e-mail providers;
7) providers of information systems;
8) Developers and technical support;
9) backup and cybersecurity providers;
10) distance learning platforms;
11) Videoconference platforms;
12) certificate providers;
13) accountants;
14) auditors;
15) lawyers and legal consultants;
16) insurers;
17) partners involved in the implementation of training or service;
18) state and municipal authorities;
19) Courts;
20) control bodies and supervisory authorities;
21) law enforcement authorities;
22) a legal successor following a reorganisation or transfer of the business;
23) other persons where the data subject is informed or disclosure is required by law.
34.2.
Access is provided only to the extent necessary and according to the recipient’s role.
34.3.
Where a supplier processes data on behalf of the merchant, the relationship shall be settled by contract and appropriate instructions.
34.4.
The processor shall not use the data for incompatible own purposes.
34.5.
Where a recipient acts as an independent controller, it is responsible for its own processing.
35. Corporate administrators
35.1.
A corporate administrator may have access to:
1) the names of the users in their organisation;
2) their business e-mail addresses;
3) roles;
4) access status;
5) the results of training;
6) company audits and reports;
7) customer content;
8) other information authorised by the corporate plan.
35.2.
The corporate administrator does not have access to:
1) complete card data;
2) personal passwords;
3) data from unrelated organisations;
4) other information beyond the rights granted to it.
35.3.
The organisation shall be responsible for granting admin rights only to appropriately authorised persons.
36. Transfers outside the European Economic Area
36.1.
We strive for personal data to be processed in the European Economic Area whenever reasonably possible.
36.2.
Some suppliers can process data in a country outside the European Economic Area.
36.3.
Such transfers take place only where an applicable mechanism is available, including:
1) a European Commission adequacy decision;
2) standard contractual clauses;
3) binding corporate rules;
4) an approved code of conduct or certification mechanism with commitments;
5) an express exception provided by law;
6) another permissible mechanism.
36.4.
Where standard contractual clauses are used, conditions in the recipient country may be assessed and supplementary measures applied where necessary.
36.5.
The data subject may request information about the applicable mechanism and how to obtain a copy of the relevant safeguards, insofar as this does not infringe third-party rights or security requirements.
37. Retention periods
37.1.
Personal data shall only be stored for the period necessary for that purpose, unless a longer period:
1) is required by law;
2) is necessary for the protection of legal claims;
3) is legally agreed;
4) is necessary for the conclusion of a dispute, verification or investigation.
37.2. User accounts
Data relating to an active account are retained for the period of registration and contractual access.
37.3.
After an account is closed, data in active systems are erased or restricted within a reasonable technical period, except for the portion necessary for:
1) contractual relationship;
2) accounting;
3) security;
4) proof of action;
5) Legal claims.
37.4.
Basic contractual and identification data may be retained until the applicable limitation periods expire, normally for up to five years after the relationship ends, unless a different period applies.
37.5. Corporate client content
The customer content shall be kept for the duration of the contract and under the agreed rules.
37.6.
Unless otherwise specifically agreed, a reasonable period for exporting content may be provided after termination, after which the content is erased or anonymised in active systems, except where retention is required by law.
37.7. Orders and contracts
Order and contract data are retained for the period of performance and the applicable limitation period.
37.8.
Where data are part of accounting information, they may be kept for the legally established accounting period.
37.9. Accounting documents
Accounting registers, financial statements and documents for tax control, audits and subsequent financial inspections are retained for the applicable statutory period, normally 10 years, calculated in accordance with the Accounting Act.
37.10. Unpaid and cancelled orders
Data on unpaid or cancelled orders may be stored for up to six months, except where necessary for the prevention of fraud, legal dispute or legal obligation.
37.11. Abandoned basket
Information about an unfinished basket may be retained for up to 30 days unless the user has saved it through their account or provided a separate basis for longer use.
37.12. Enquiries
Enquiries that do not lead to a contract may be retained for up to two years after the last substantive communication.
37.13. Withdrawals, returns and product complaints
Data relating to withdrawals, returns, product complaints and other complaints may be retained for up to five years after the case is closed.
37.14.
Documents representing accounting information shall be kept for the relevant longer legal period.
37.15. Trainings
Data relating to participation, attendance, progress and results may be retained for up to five years after training ends, unless the specific programme or the law requires a different period.
37.16. Certificates
Basic information needed to verify an issued certificate may be retained for up to 10 years or for the certificate’s period of validity, where necessary to verify authenticity.
37.17. Marketing
Marketing data are retained until consent is withdrawn, an objection is made, the legal basis ceases to apply or prolonged inactivity is identified.
37.18.
A minimal record of a marketing opt-out may be retained for as long as necessary to respect the objection.
37.19. Evidence of consent
Consent records may be retained for up to five years after withdrawal or termination of the relevant activity, where necessary to demonstrate lawfulness.
37.20. Technical Logs
Ordinary technical and security logs may be retained for up to 12 months.
37.21.
Logs relating to an incident, fraud, dispute or breach may be retained until the matter is finally resolved and the applicable period for claims has expired.
37.22. Cookies
The duration of each cookie is specified in the Cookies Policy or the consent management mechanism.
37.23. Backups
Data erased from active systems may remain temporarily in protected backups until the backup retention cycle expires.
37.24.
Backups are not used for ordinary active processing and are restored only where necessary for system recovery, security or a legal obligation.
37.25. Legal claims
Where there is a dispute, inspection or legal proceeding, the relevant data may be retained until the matter is finally resolved and the subsequent period for legal protection has expired.
38. Erasure, restriction and anonymisation
38.1.
After the applicable period has expired, personal data are:
1) erased;
2) destroyed;
3) irreversibly anonymised;
4) restricted where temporary retention is required by law or a dispute.
38.2.
Where the data must be preserved by law, they shall not be used for an incompatible new purpose.
38.3.
Erasure from all backups may take place gradually during their normal rotation.
38.4.
When a backup is restored, procedures may be applied to erase again data that were previously lawfully erased.
39. Technical and organisational measures
39.1.
The merchant shall apply appropriate measures taking into account the risk, nature, scope, context and purposes of the processing.
39.2.
The measures may include:
1) access control;
2) individual user profiles;
3) roles and permissions;
4) cryptographic password protection;
5) protected transmission of information;
6) registration of administrative actions;
7) backups;
8) protection against unauthorised access;
9) updating systems;
10) vulnerability management;
11) limiting unsuccessful sign-in attempts;
12) protection of the payment process;
13) separation of environments;
14) incident procedures;
15) contractual confidentiality obligations;
16) training of persons with access;
17) a periodic review of rights;
18) Minimization of data;
19) pseudonymisation, where appropriate;
20) physical protection of infrastructure;
21) other measures as technology develops.
39.3.
Access is limited to individuals who need it for their work or contractual duties.
39.4.
The provision of specific details of the protection may be restricted where disclosure would create a security risk.
39.5.
No system can guarantee absolute protection against all possible risks.
39.6.
This does not release the Merchant from the obligation to apply appropriate measures and respond to incidents.
40. Users’ security responsibilities
40.1.
The user should:
1) use a strong and unique password;
2) not share their password;
3) not allow unauthorised people to use their account;
4) sign out of their account on a shared device;
5) keep their device and browser up to date;
6) not open suspicious links;
7) report suspected compromise;
8) check the website address;
9) not send payment codes or passwords;
10) respect access permissions in the corporate account.
40.2.
If unauthorised access is suspected, the user should immediately change their password and contact the Merchant.
41. Security breaches
41.1.
When a breach is identified, the Merchant assesses:
1) the nature of the data;
(2) the number of persons concerned;
3) the possible consequences;
4) the likelihood of harm;
5) the protective measures taken.
41.2.
Where required by law, the supervisory authority is notified without undue delay and, where possible, within 72 hours of becoming aware of the breach.
41.3.
Where the breach may result in a high risk to individuals’ rights and freedoms, affected individuals are notified without undue delay, unless a legal exception applies.
41.4.
The notification may contain:
1) the nature of the breach;
(2) the possible consequences;
3) the measures taken;
4) recommendations to the person;
5) contact for further information.
42. Automated decision-making and profiling
42.1.
Unless the individual is expressly informed in a separate notice, the Merchant does not make decisions based solely on automated processing that produce legal effects or similarly significantly affect the individual.
42.2.
Automatic rules may be used for:
1) protection against spam;
2) detecting unusual sign-in attempts;
3) verification of technical validity;
4) calculation of price and delivery;
5) activation after successful payment;
6) display content according to the purchased plan;
7) other routine operations without significant legal impact.
42.3.
If automated decision-making with a significant impact is introduced, information will be provided about:
1) logic;
2) its significance;
3) the possible consequences;
4) the right to human intervention;
5) the right to express an opinion;
6) the right to challenge the decision.
43. Right to information
43.1.
The data subject has the right to receive clear, understandable information about processing.
43.2.
The information shall be provided by:
1) the current policy;
2) Cookies Policy;
3) notifications upon registration;
4) information on ordering;
5) contracts;
6) Special notifications;
7) response to an individual request.
44. Right of access
44.1.
The data subject may request confirmation of whether their personal data are being processed.
44.2.
Where data are processed, the data subject may request:
1) a copy of the data;
2) the purposes;
3) categories of data;
4) recipients;
5) the retention period or criteria;
6) the source;
7) information on rights;
8) information about international transfers;
9) information about automated decisions, where applicable.
44.3.
The right to a copy shall not adversely affect the rights and freedoms of others.
45. Right to rectification
45.1.
The data subject may request correction of inaccurate personal data.
45.2.
Taking the purpose into account, the data subject may request completion of incomplete data.
45.3.
Some data can be corrected directly through the profile.
46. Right to erasure
46.1.
The data subject may request erasure where:
1) the data are no longer necessary;
2) consent has been withdrawn and there is no other legal basis;
3) a justified objection has been made;
4) the data were processed illegally;
5) the deletion is required by law;
6) another ground under the GDPR applies.
46.2.
The right to erasure is not absolute.
46.3.
Data may be retained where necessary for:
1) fulfilling a legal obligation;
(2) exercising the right to freedom of expression and information;
3) public interest;
4) archival, scientific or statistical purposes under the applicable conditions;
5) establishment, exercise or defence of legal claims;
6) another legal basis.
46.4.
Deleting an account does not automatically erase invoices, contractual records or other data that must be retained.
47. Right to restriction of processing
47.1.
The data subject may request restriction where:
1) they contest the accuracy of the data;
2) processing is unlawful but they do not want erasure;
3) the Merchant no longer needs the data, but the data are needed for a legal claim;
4) an objection has been submitted and is being examined.
47.2.
Where processing is restricted, the data are normally retained but are not used for other activities without an applicable legal basis.
48. Right to data portability
48.1.
Where processing is automated and based on consent or a contract, the data subject may have the right to receive the data they provided in a structured, commonly used, machine-readable format.
48.2.
Where technically possible, the individual may request that the data be transmitted directly to another controller.
48.3.
The right to portability does not apply to all data and must not adversely affect third-party rights.
49. Right to object
49.1.
The data subject may object to processing based on legitimate interests for reasons relating to their particular situation.
49.2.
Following an objection, processing stops unless the Merchant demonstrates overriding compelling legitimate grounds or the data are necessary for legal claims.
49.3.
An objection to direct marketing is respected without requiring the individual to provide a specific reason.
50. Right to withdraw consent
50.1.
Where the processing is based on consent, it may be withdrawn at any time.
50.2.
Withdrawing consent must be as easy as giving it.
50.3.
Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
50.4.
Withdrawing marketing consent does not stop contractual messages.
51. Rights relating to automated decisions
51.1.
Where applicable, the data subject has the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects them.
51.2.
Where an exception applies, the individual may have the right to:
1) human intervention;
2) expression of a view;
3) contesting the decision.
52. Exercise of the rights
52.1.
A request may be submitted to:
LEAN BULGARIA OOD
Email: admin@leanchampionscommunity.com
Address: Sofia, 55 Kiril Popov Street, entrance A, floor 1, apartment 4, Republic of Bulgaria
52.2.
The recommended email subject line is:
“Personal data request”
52.3.
The request should contain:
1) name;
2) way of contact;
3) a description of the action requested;
4) information allowing the account or relationship to be identified;
5) the preferred way to receive a response.
52.4.
The individual is not required to identify a specific article of the GDPR.
52.5.
Where the Merchant acts as a processor, the request may be forwarded to the relevant corporate controller.
53. Identity check
53.1.
Where there are reasonable doubts about identity, additional information may be requested.
53.2.
The verification shall be:
1) necessary;
2) proportionate;
3) appropriate to the risk;
4) limited to minimum information.
53.3.
A copy of an identity document is not required by default.
53.4.
Where possible, less intrusive methods are used, such as:
1) confirmation from the registered e-mail address;
2) login to the profile;
3) order number;
4) limited verification of known data;
5) another secure method.
54. Response deadline
54.1.
The Merchant responds without undue delay and, as a rule, within one month of receiving the request.
54.2.
Where requests are complex or numerous, the period may be extended by a further two months.
54.3.
The individual is informed of the extension and the reasons within one month of receipt of the request.
54.4.
Where no action is taken, the individual is informed of the reasons and of the option to lodge a complaint or seek a judicial remedy.
55. Fees
55.1.
As a rule, exercising these rights is free of charge.
55.2.
Where a request is manifestly unfounded or excessive, particularly because it is repetitive, the Merchant may:
1) charge a reasonable fee reflecting the administrative costs;
2) refuse to take action.
55.3.
The Merchant is responsible for demonstrating that a request is manifestly unfounded or excessive.
56. Right to lodge a complaint with a supervisory authority
56.1.
The data subject has the right to lodge a complaint with the Commission for Personal Data Protection if they consider that processing infringes applicable legislation.
56.2.
Contact details of the Commission for Personal Data Protection:
Address: 2 Prof. Tsvetan Lazarov Boulevard, Sofia 1592, Republic of Bulgaria
E-mail: kzld@cpdp.bg
Website: cpdp.bg
56.3.
The right to lodge a complaint does not depend on a mandatory prior request to the Merchant.
56.4.
The data subject also has the right to an effective judicial remedy.
57. Children’s data
57.1.
The Platform is intended primarily for adults, professionals, organisations and individuals who can validly enter into a contract.
57.2.
We do not knowingly collect children’s personal data for marketing without an appropriate legal basis.
57.3.
Where processing of data relating to a person under 14 is based on consent in connection with the direct offer of an information society service, consent must be given or authorised by a parent or guardian under applicable Bulgarian law.
57.4.
Where training or another service is intended for minors, separate, appropriate information is provided and the necessary measures are taken.
57.5.
If children’s data are found to have been collected without the necessary legal basis, they are erased or the processing is brought into compliance without undue delay.
58. External links and services
58.1.
The platform may contain links to external websites and services.
58.2.
The merchant shall not determine how an independent external controller processes the data after visiting its page.
58.3.
The user should read the privacy policy of the relevant external service.
58.4.
Where an external service is embedded in the Platform, the necessary information is provided and consent obtained in accordance with applicable law.
59. Social networks
59.1.
When a person interacts with a Lean Champions profile on a social network, the social network operator can also process data as an independent controller.
59.2.
We can get information that the person:
1) has made public;
2) sent by personal message;
3) has submitted by comment;
4) has shared through a function of the social network.
59.3.
Data are not automatically added to a marketing list without an applicable legal basis.
60. Policy changes
60.1.
The Policy may be updated following:
1) change of legislation;
2) change of services;
3) introducing a new method of payment;
4) adding a new module;
5) change of suppliers;
6) changing storage times;
7) a change to international transfers;
8) development of security measures;
9) another objective reason.
60.2.
The current version is published with a version number, effective date and date of the latest update.
60.3.
Where a change is material, affected individuals may be informed through:
1) email;
2) message in the profile;
3) notice on the website;
4) another suitable channel.
60.4.
Where consent is required for a new purpose, updating the Policy does not itself replace that consent.
60.5.
Previous versions may be archived as evidence of the information provided.
61. Contacts
61.1.
In the case of questions, requests or complaints concerning personal data, you may contact:
LEAN BULGARIA OOD
Unified Identification Code (UIC): 203317933
VAT identification number: BG203317933
Address: Sofia, 55 Kiril Popov Street, entrance A, floor 1, apartment 4, Republic of Bulgaria
Email: admin@leanchampionscommunity.com
Telephone: +359 896 060 911
Website: leanchampionscommunity.com
61.2.
For faster processing, specify:
1) your name;
2) the e-mail address used;
3) the organisation, where applicable;
4) the order or account number, where known;
5) a clear description of the request;
6) a preferred contact method.
61.3.
Do not send by email:
1) full bank card number;
2) security code;
3) password;
4) a two-factor authentication code;
5) other unnecessary authentication credentials.
62. Entry into force
62.1.
This Privacy Policy takes effect on the date stated in the ‘Effective from’ field.
62.2.
This version applies to processing from its effective date.
62.3.
Where specific processing is governed by a separate contract, specific notice or personal data processing agreement, those documents apply together with this Policy.
62.4.
Where a provision of this Policy conflicts with a mandatory legal rule, that rule applies without affecting the rest of the Policy.