“FINN FOODS COMMERCE LTD. – a company registered on the territory of the Republic of Bulgaria, with registered office and registered address. registered office and head office at. “207158115, tel.: 0887440306 and email:
contact@tokyosushi.bg
In connection with its activity – offering restaurant services – Tokyo Sushi Restaurant – the “Company” processes data, some of which is personal data, according to the Personal Data Protection Act and Regulation (EU) 2016/679, and therefore has the capacity of a personal data controller.
This policy is intended to inform users of www.tokyosushi.bg of the manner in which their personal data is processed, their rights, the methods of personal data protection used by the controller, to whom the Company is entitled to provide the personal data collected, and the methods of exercising the rights of data subjects.
Policy objectives and scope:
With this Privacy Policy, Finn Foods Commerce Ltd. takes into account the confidentiality and privacy of personal data. In accordance with legislation and best practices, the Company applies the required technical and organizational measures to protect the personal data of individuals.
With this Personal Data Protection Policy, the Company aims to inform individuals about the purposes of processing personal data, the recipients or categories of recipients to whom the data may be disclosed, the mandatory or voluntary nature of providing the data and the consequences of refusing to provide them, information about the right to access and correct the collected data.
Basic terms and definitions:
“personal data” means any information relating to an identified natural person or an identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person
“processing” means any operation or set of operations which is performed upon personal data or a set of personal data, whether or not by automatic means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
“restriction of processing” means the marking of stored personal data in order to restrict its processing in the future;
“profiling” means any form of automated processing of personal data consisting in the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects relating to the performance of that natural person’s professional duties, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;
“administrator” means a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its determination may be laid down in Union or Member State law;
“data processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
“recipient” means the natural or legal person, public authority, agency or other body to whom the personal data are disclosed, whether or not it is a third party. At the same time, public authorities which may receive personal data in the framework of a specific investigation in accordance with Union law or the law of a 4.5.2016 L 119/33 Official Journal of the European Union EN Member State shall not be considered as ‘recipients’; the processing of those data by those public authorities shall comply with the applicable data protection rules according to the purposes of the processing;
“third party” means a natural or legal person, public authority, agency or any other body other than the data subject, the controller, the processor and persons who, under the direct authority of the controller or the processor, are entitled to process the personal data;
“consent of the data subject” means any freely given, specific, informed and unambiguous indication of the data subject’s wishes, by means of a statement or a clear affirmative action, which indicates his or her consent to the processing of personal data relating to him or her;
All quoted terms and definitions are in accordance with the legal definitions given by Regulation 2016/679 (the Regulation).
Principles of personal data processing applied by the Company:
personal data is processed lawfully, fairly and transparently;
specific purposes for processing the data are necessary;
data minimization;
limitation of the storage of personal data over time;
ensuring the security of personal data.
Purposes and basis for processing personal data:
The main activity of the Company is to fulfill the orders from the users of the website, as well as to offer reservation services in the restaurant “Tokyo Sushi” on the territory of the city of Tokyo. The company offers the services of reservation of Tokyo Restaurant. For this purpose, it is necessary to collect the necessary information about the user for the specific service requested.
Another main basis for collecting personal data is direct marketing. The Company collects personal data for marketing and advertising purposes. The data is collected only with the user’s express, free, clear and informed consent, which the user has indicated when reading this privacy policy. Any natural person who has consented to be the subject of direct marketing by the Company shall have the possibility to withdraw their consent at any time, in an easy and convenient way, on the principle of transparency enshrined as a fundamental principle in the Regulation.
The Company processes personal data only when:
has obtained clear, free, informed and unambiguous consent from data subjects who have been informed in advance of what their personal data will be used for by this policy;
where there is a contractual obligation, for the purpose of performance of a contract, one party being the natural person (where the Company processes data of its employees) and for the exercise, establishment and protection of rights and legitimate interests;
where processing is necessary for the performance of a task carried out in the public interest (under EU or national law);
has obtained explicit consent from the individual for direct marketing purposes (e.g. sending email advertising).
Data collected and processed:
Important: Finn Foods Commerce Ltd. does not collect or process sensitive personal data of its customers and users.
The data collected and processed are:
Name and surname of the user – in order to identify the subject when a service is requested;
E-mail address – for quick and easy correspondence;
Phone number – for direct contact with the data subject;
Address for delivery (only if delivery is specifically requested by the user);
Other as permitted under the Regulation if it is necessary for the performance of an obligation of the Company or related to a particular service.
The sender of personal data has the right not to share all the personal data requested. In cases where this personal data is necessary for the performance of a specific service a particular specialized function or an effective response to a request (excluding direct marketing) – e.g. delivery of food to a specific address, Finn Foods Commerce Ltd. could not fulfill the request due to lack of data, which the user is explicitly notified of through the personal data policy.
Where, in connection with the Company’s business, it is necessary to process or store the data of persons under the age of 18, this shall be done with the express consent of the parent/guardian.
Recipients of personal data:
The Company has the right and the obligation to provide the personal data of the data subjects to certain state institutions in order to comply with the Bulgarian legislation, namely: in relation to the data collected from the Company’s employees – National Revenue Agency, National Social Security Institute, Employment Agency, etc. Data may be provided to accounting houses, banking organizations, HR agencies and mobile operators;
The Company has the right to provide the data of individuals to hospitals, judicial and investigative authorities;
The personal data of users of www.tokyosushi.bg is not provided to third parties outside the scope of their expressed consent or the requirements of law.
The Company does not share data of individuals to organisations outside the European Union.
Storage period of personal data:
“Finn Foods Commerce Ltd has shortened the storage period of personal data to a minimum. The Company shall destroy the data as soon as the purpose for which they were collected has been fulfilled, unless the data are necessary for the performance of a task carried out in the public interest or in connection with the exercise of official authority vested in data controllers under Union law or pursuant to Art. the law of a Member State, as well as in relation to the requirement of Bulgarian law;
The storage criteria are:
when ordering without the person registering, the data is kept for 6 months after the last order;
the personal data of employees of Finn Foods Commerce Ltd. is stored and processed for a longer period in view of the requirement of the Accounting Act;
Privacy:
The Company has taken all necessary technical and organizational measures to protect the personal data of individuals from accidental or unlawful destruction or accidental loss, from unauthorized access, alteration or dissemination, as well as from other unlawful forms of processing by using specialized software and antivirus programs, as well as the services of an IT specialist. Personal data stored on paper is held in folders which are stored in rooms to which access is restricted and which are fitted with fire extinguishers to protect against fire. “The “Company” has a CCTV system in place to protect the premises, machinery and personal data of Finn Foods Commerce Ltd. employees and customers.
Data Protection Officer
Due to the fact that the Company processes on a large scale and stores personal data of a large number of individuals (customers and users of www.shtastliveca.com), Finn Foods Commerce Ltd. uses the services of a Data Protection Officer who is responsible for the proper implementation of Regulation (EU) 2016/679 and the protection of the rights of data subjects;
Consumer rights:
Users’ right of access to data relating to them;
Right to rectification;
Right to object to data processing;
Right to erasure (right to be forgotten);
Right to restriction of processing;
Right to data portability;
The right to withdraw consent at any time, without prejudice to the lawfulness of processing based on consent given before it is withdrawn.
Where personal data are processed for direct marketing purposes, the consumer shall have the right to object at any time to processing of personal data concerning him or her for this type of marketing. The user shall be informed in advance of the existence of the right to object, which shall be made available to him by means of a notification in a clear manner and separate from any other information.
Policy changes:
The Company has the right to update, amend and supplement the Privacy Policy at any time in the future when circumstances so require.
Contact details of the data controller:
Address. Address. “3, Bitola Str.
Contact telephone number: 0887440306
E-mail: contact@tokyosushi.bg
Data Protection Supervisor
The data protection supervisory authority at national level is the Commission for Personal Data Protection. It ensures the correct application of Regulation (EU) 2016/679 and any individual who considers that his or her rights have been infringed in relation to the processing of personal data may lodge a complaint with the Commission at the following address:
Gr. Sofia, ul. “Proff. Tsvetan Lazarov” № 2
phone: 02/91-53-555
E-mail: kzld@cpdp.bg
Website: www.cpdp.bg