Политика за поверителност

PRIVACY POLICY

regarding the collection, processing, and storage of personal data of natural persons by the "Future Inventors" Foundation, in connection with the requirements of Regulation (EU) 2016/679 (GDPR) and the Personal Data Protection Act (PDPA) of the Republic of Bulgaria.

I. Data Controller Information:

Name: "Future Inventors" Foundation (Фондация „Бъдещи изобретатели“)
Registered Office and Address of Management: Sofia, P.C. 1505, 28 Kaymakchalan Str., ground floor, Bulgaria
Correspondence Address: Same as the address of management
Registered in the Commercial Register and the Register of NPLE under UIC: 208486232
Contact Details: * e-mail: info@futureinventors.bg
- tel.: +359876012840
- Website: fll.bg

II. Categories of Personal Data Collected by the Foundation and Purposes of Processing:

The "Future Inventors" Foundation collects Uniform Civil Numbers (EGN) / Personal Numbers of Foreigners (LNCh) and ordinary personal data (names, address, email, telephone, school affiliation, etc.). Personal data is collected, stored, and processed for specific and legitimate purposes as follows:

For Human Resources and Volunteer Management: For the conclusion, execution, and tax/social security reporting of employment contracts, civil contracts, and volunteer agreements, the following data is processed: three names, permanent address, EGN, ID card details, bank account number, education, qualification, work experience, telephone number, email, and signature.
For Financial and Accounting Activities: For the conclusion of contracts with suppliers and partners, issuing invoices, tracking payments, and fulfilling legal obligations under the Accountancy Act, the following data is collected: three names, address, EGN (for natural persons), telephone number, email, and signature.
For Newsletters and Marketing: For promoting the Foundation's activities, sending event invitations, news, and offers, the following data is collected and processed: name, telephone, and email of natural persons (strictly subject to prior explicit consent).
For Organizing and Conducting Competitions, Festivals, and Events under the FIRST LEGO League Program:
- For underage participants (students): Subject to the consent of their parents/guardians, the following data is collected and processed: three names, age/date of birth, EGN (if necessary for insurance or travel purposes), school/team, city, identification document details (for international travel), specific health status (allergies, dietary requirements for safety purposes during events).
- For parents/guardians and team mentors (coaches): Three names, telephone number, email, address, signature, and relationship/affiliation to the specific team/student.
For Conducting Training, Seminars, and Certification of Mentors, Judges, and Teachers: For issuing certificates, credentials (including those under the standards of the Ministry of Education and Science, if applicable), organizing logistics, and feedback, the following data is collected: three names, place of work/school, EGN, date and place of birth (if required for an official register), telephone number, email, and signature.

III. Categories of Personal Data Recipients Outside the Foundation and Transfer of Data to Third Countries:

Data under Section II.1 and Section II.2 is transferred to the National Revenue Agency (NRA), the National Social Security Institute (NSSI), the servicing accounting company/accountant, and banking institutions.
Data under Section II.3 is processed through secure bulk email marketing platforms that guarantee information security.
Data under Section II.4 (FIRST LEGO League) is stored in a secure cloud storage space of the Foundation with restricted access. Since the Foundation is the operational partner of the FIRST LEGO League program for Bulgaria, certain parts of the data (team names, mentors, participant lists for registration) may be shared or entered into the official platforms of the international organization FIRST and/or LEGO Education (located in the USA/EU) in compliance with standard contractual clauses for data protection. When organizing events, data may be shared with tour operators, hotels, and insurance companies.
Data under Section II.5 is used for issuing documents and, where necessary, is submitted to the Ministry of Education and Science (MES) or the respective Regional Departments of Education (RUO) in accordance with regulatory requirements.

IV. Data Retention Period:

Data concerning employment and social security relations (Section II.1) is stored for 3 to 50 years in accordance with the requirements of the law.
Accounting documents and contracts (Section II.2) are stored for a period of 10 years (plus 5 years under the PDPA for statute of limitations) – 15 years in total.
Data for marketing purposes (Section II.3) is stored until the consent is withdrawn by the individual.
Data for participants, mentors, and events under FIRST LEGO League (Section II.4) is stored for a period of up to 5 years from the end of the respective competition season for the purposes of reporting to the international organization and internal statistics, unless the law requires a longer period (e.g., for insurance or financial transactions).
Data from training sessions (Section II.5) is stored for up to 15 years to enable the re-issuance of lost certificates/credentials.

V. Provision of Personal Data – Statutory or Contractual Requirement:

The provision of data for contracts and accounting (Section II.1 and Section II.2) is a legal and contractual requirement. Without it, the Foundation cannot conclude a contract or make a payment.
Subscribing to newsletters (Section II.3) is entirely voluntary.
Participation in FIRST LEGO League events and competitions (Section II.4) requires the processing of personal data. If parents or mentors refuse to provide the necessary information for registration and safety, the student/team will not be able to participate in the competitions and events.
Data for training sessions (Section II.5) is necessary for issuing legitimate documents. In case of refusal, a certificate cannot be issued.

VI. Automated Decision-Making and Profiling:

The "Future Inventors" Foundation does not use the collected personal data for automated decision-making, including profiling of natural persons.

VII. Rights of the Data Subjects:

Every natural person whose data is processed has the following rights:

Right of access to their personal data and information about its processing.
Right to rectification of inaccurate or incomplete data.
Right to erasure ("right to be forgotten") when the legal basis for processing has ceased to exist.
Right to restriction of processing in the event of a legal dispute.
Right to data portability in a structured, commonly used format.
Right to object to processing based on legitimate interest or for direct marketing purposes.
Right to withdraw consent (for processing purposes based on consent).

Applications for exercising these rights shall be submitted in writing to the specified correspondence address or electronically to the Foundation's email. They will be reviewed within one month in accordance with the requirements of the GDPR.

VIII. Right to Lodge a Complaint with a Supervisory Authority:

If you believe that your rights under the GDPR have been violated, you have the right to lodge a complaint with the Commission for Personal Data Protection (CPDP) or with the court.

Contact details of the CPDP (КЗЛД):

Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
Tel: +359 2 915 3580; Email: kzld@cpdp.bg; Website: www.cpdp.bg