PRIVACY POLICY

(effective as from 25.05.2018 г., amended on 26.03.2020)

WHO WE ARE AND WHAT IS THE PURPOSE OF THIS POLICY?

ART FEST EOOD, UIC 130550061, having its seat and registered address at Sofia 1000, 20, Serdika Str., 4th floor, apt. 3 (referred to in this Privacy Policy as “we”, “our” or “us”) owns and operates several institutions under one roof: Sofia International Film Festival, Sofia Film Fest on the Road, Sofia Film for Students, Sofia Meetings, and the House of Cinema.

We are committed to protecting your personal data and this document (the "Privacy Policy") describes the ways in which we collect personal data how we hold and use personal data and how we respect your privacy rights.

This Privacy Policy applies to the use of the following websites: https://siff.bg/, http://sofiameetings.siff.bg/, https://vp.eventival.com/siff/2021, https://online.siff.bg/, https://domnakinoto.com/, https://ontheroad.siff.bg/, https://students.siff.bg/, https://virtualmeetingssm.siff.bg/ as well as for our social media presence.

The operators of our online services are committed to protecting the privacy of your personal data. We will treat your personal data confidentially and in compliance with statutory data protection regulations as well as this Privacy Policy.

Under the General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”), we are the “personal data controller” of your personal data.

In addition, for the purposes of this Privacy Policy:

“Personal Data” means any information related to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, psychological, mental, economic, cultural or social identity of that natural person.

“Personal Data” does not include data that cannot be related to or associated with a particular natural person.

“Sensitive Personal Data” includes personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

We do not process sensitive personal data unless necessary to carry out our regulatory obligations, for example the obligations we have under the labour or anti-discrimination laws. Please do not send or otherwise provide us with any sensitive personal data related to you (or someone else) unless we have expressly asked you to do so in writing and after we have confirmed to you that we have the necessary consents and that all other legal requirements for data processing have been met.

THE PERSONAL DATA WE COLLECT AND HOW WE PROCESS IT

We collect and use the personal data that you provide to us directly, for example when you purchase tickets for our events or apply for accreditation or registering your film. In addition to the information you provide us directly, we receive information about you from others, including film institutes and other partner organisations to receive information on films and industry professionals and social media providers for promotional services when you sign up to follow our pages or profiles.

The personal data we process include:

Basic information, such as your name (including title), picture, the organization you represent or work for and your position in the same.
Contact information, such as postal address, email, and telephone number.
Financial information, such as your credit/debit card number or your bank account in respect to a particular transaction.
Professional information, such as your personal biography.
Technical information, such as data generated as a result of your use of the Website or an application embedded in the same (app, plug-in, etc.), as well as information regarding materials and communication received from you or sent to you electronically.
Marketing and Communications Data such as your preferences in receiving newsletters from us as well as your communication preferences.
Details of participants’ visits to our events, to their presence in the context of the festival, Sofia Meetings and other events.

For more detailed information you can read the below which outlines how we use your personal data:

1. Processing any orders that you place with us for tickets and passes for the events organized by us and facilitating your entry to these events:

In connection with the processing of your order, we collect information such as your name, e-mail address, telephone number, the tickets/passes ordered. In cases where you benefit from a student or pensioner discount, we may require your school / student book or an identity document for confirmation.

We collect payment details to process the order you place with us. We share these details with our subcontractors acting as payment processors (for example PayPal and payment gateway services providers) or providing electronic reservations services (ABS Bulgaria EOOD).

We use your contact information to keep you informed of the status of your order.

We may use your name, address, and personal identification number (e.g.,ЕГН) to prepare accounts, invoices, credit/debit notes and statements for our sales.

When we collect personal data through forms, fields marked with an asterisk are mandatory. Some of the personal data we request from you are either necessary for us to perform a contract between, or to provide you with a service you have asked for, or to comply with legal requirements. If you do not provide the personal data marked with an asterisk, this may affect the goods and services that we can provide.

Legal basis:

Insofar as the purpose relates to the execution of a contract agreed with you or the provision of a service requested by you, the legal basis is Article 6 (1) b GDPR.

2. Receiving access to online streaming

You have the option of creating a user account in our online areas such as the user area under https://online.siff.bg/. This is particularly necessary for the registration and for using our streaming portal https://online.siff.bg/. As part of the registration process the required information is communicated to the user. User accounts are not public and cannot be indexed by search engines.

For the provision of our streaming portal https://online.siff.bg/ we use the service provider Shift72 in New Zealand. In the context with the provision of the streaming portal by the service provider, the service provider may access personal data of the users of our streaming portal (inventory data at login, IP address, payment data, usage data). We concluded a data processing agreement according to Art. 28 GDPR with the service provider. When using the streaming portal, personal data may be transferred to a third country outside the EU without an adequate level of data protection. There are appropriate safeguards for such a data transfer in accordance with Art. 46 GDPR. We will be happy to provide you with proof of the appropriate safeguards (standard data protection clauses) at any time on request. To do so, please contact us using the contact details given below. Detailed information on data protection at Shift 72 can be found here: https://www.shift72.com/privacy-policy.

Legal basis:

Insofar as the purpose relates to the execution of a contract agreed with you or the provision of a service requested by you, the legal basis is Article 6 (1) b GDPR.

We also use your IP address to conduct a geolocation to determine from which region you are visiting our streaming portal and, based on this information, to be able to show the streaming content.

Legal basis:

The legal basis for this geolocation is Art. 6 (1) f GDPR. Our legitimate interest to guarantee compliance with the respective license restrictions as to the streaming content.

3. Receiving accreditationand registration of a film for the Sofia International Film Festival or the Sofia Meetings.

In order to enable you to participate in Sofia International Film Festival or Sofia Meetings, we process the following personal data: names, title, language of communication, address, organization and position in the organization, phone number, email address, website, length of stay, your payment details, if applicable, your hotel in Sofia, if applicable, nationality, primary area of work, contribution to selected film if applicable, portrait photograph and your professional identification (e.g. press pass).

If a film is submitted, we will also store the data related to the film and, if necessary, the film file itself. In addition, we will store your participation in Sofia International Film Festival and Sofia Meetings.

Your participation will require the registration of your information in our organizational system on the following links: https://vp.eventival.com/siff/2021 and https://virtualmeetingssm.siff.bg/login/.

Eventival is a professional event management tool used by many film festivals around the world made by a service provider based in the Czech Republic. This personal data is used strictly for processing your participation (confirmation of participation, travel, hotel, planning, etc.) and provide you with practical information about the event.

The data protection policy of Eventival can be found below: www.eventival.com/fr/privacy-policy

B.square is a B2B matchmaking event management platform used by many industries and film festivals around the world made by a service provider based in Italy. This personal data is used strictly for processing your participation (confirmation of participation, planning, accepting appointments, attendance etc.) and provide you with practical information about the event.

The data protection policy of b.square can be found below: https://www.bdotsquare.com/privacy.html

We pass on these data to external service providers if this is necessary to fulfil our contractual relationship with you. If a film is submitted, we will pass your data on to the selection juries, whom we have obliged to observe to data protection. If you participate in the festival, the data will be forwarded in order to organize the festival security, your hotel accommodation, the festival transport service and the provision of your tickets. If you require a visa to enter the country, we will inform the Ministry of Foreign Affairs and the respective embassy in order to support your visa application.

Legal basis:

This processing of your data is performed in order to fulfil our obligations arising in connection with your film submission or your accreditation (Art. 6 (1) b GDPR).

In order to safeguard our legitimate interests, we publish your data as participants and make them available to other members of the film industry who are involved in the festival, our sponsors and the press. In the pursuit of the same interests, namely to promote networking in the international film scene, we also publish your data on the festival catalogue. Furthermore, we use your data to invite you to future festivals and inform you about our program.

Legal basis:

This processing of your data is performed on the basis of a weighing of interests (Art. 6 (1) (f) GDPR). You may object to this form of processing and the disclosure at any time by sending an email to office@siff.bg .

4. Applying for open positions as our employees or volunteers. Agreement conclusion with subcontractors and the jury of the festival

We collect and process the personal data of employment applicants, volunteers, and subcontractors for the purpose of conducting the application process. As part of the application process, all the personal data you enter is processed: name, personal identification number (ЕГН), date of birth, contact data such as address, email address, telephone number, professional history, qualifications and/or a degree, application photos, information on desired salary. We process also the personal data of the selected jury of the festival that includes name, contact information, professional biography and photo.

If an applicant submits his or her application documents to us electronically, this processing is carried out electronically.

For the purpose of processing volunteers’ applications we may use our partner CVS Bulgaria where the application may be submitted online on https://cvs-bg.org/proekti/sofia-film-fest/, which partner processes your data for the purpose of conducting the application procedure on our behalf and in compliance with the legal requirements. We have obliged the company to ensure and comply with data protection with a contract for personal data processing.

We use the personal data you enter exclusively for processing your application for the advertised position. If we sign a contract with you, your data will be stored for the purpose of processing the employment/volunteer or contractor or jury relationship and in compliance with the legal requirements.

If your application is unsuccessful, we erase your data after you have been notified of the rejection.

Legal basis:

As long as the purpose for personal data processing relates to the performance of a contract or the steps that are to be taken prior to entering into a contract, the legal basis for the processing is Art. 6 (1) clause (b) GDPR.

5. Photos taken / videos filmed at the festival and Sofia Meetings

Professional photos/videos will be taken/filmed at the festival and during Sofia Meetings and may be used for promotional purposes after the event. If you do not wish your image to appear, please let us know on your arrival at the venue. If you want the photos in which you are identifiable to be destroyed, please send your request to office@siff.bg. We will ask permission of adults accompanying children before publishing photos in which they are identifiable.

Legal basis:

6. Interacting with our Social Media Pages

We maintain publicly available profiles on the social media networks Facebook, Twitter, Instagram, and YouTube (“Social Media Pages”). If you visit one of our Social Media Pages and are logged in to the respective social media network, your usage behavior can be analyzed, and the information collected can be assigned to your account with the social media network and enriched there. Even if you are not logged in or if you do not have an account with the respective social media network, data about your person can be collected by the provider of the respective social media network, for example your IP address or data collected via a cookie. The operators of the social media networks can use this data to create user profiles. Your user profile can then be used to display interest-based advertisements on the social media network sites and other sites. If you visit one of our social media pages, we are responsible, together with the social media network provider, for the collection and processing of your personal data on that site. Information on the collection and processing of your personal data can be found here:

- Facebook: https://www.facebook.com/about/privacy/

- Twitter: https://twitter.com/en/privacy

- Instagram: https://help.instagram.com/155833707900388

- Youtube https://support.google.com/youtube/topic/2803240?hl=en&ref_topic=6151248

We will be happy to provide you with information on suitable guarantees for data transfer to third countries in accordance with Art. 46 GDPR at any time on request. You can assert your data subject rights in accordance with Chapter III of the GDPR (right to information, correction, deletion, restriction of processing, data transferability etc.) both against us and against the provider of the respective social media network. In this context, we would like to point out that we can only influence the processing of personal data and the implementation of the rights of the persons concerned within the framework of our social media pages within the scope of the possibilities made available to us by the respective provider.

Legal basis:

The legal basis for our use of social media pages is Art. 6 (1) f) GDPR. Our legitimate interest is the presence and marketing of our services on the Internet.

7. Participation in Young Audience Award

The European Film Academy Young Audience Award is an all-European one-day children’s event held in the beginning of May and organized by the European Film Academy, which we have been a part as a national representative.

To enable a child to participate in the Young Audience Award we process your child’s e-mail address, name and surname, date of birth and address (city). In case we collect this information directly from your child, we will provide notice and obtain parental consent in accordance with applicable law. We may also use a parent’s contact information to communicate with the parent regarding the child’s activities on the Young Audience Award. We will not keep the child’s personal data unless you as a parent give us permission to do so. To protect your child’s safety, we ask for proof of your identification. We may deny access if we believe there is a question about your identity.

At any time, you can review the personal information we have collected about your child, request deletion, or refuse to allow further collection or use of that information. If you need to make a data-related request, contact us at office@siff.bg.

8. Contacting us by e-mail, phone or through a contact form

We keep records of our correspondence with you when you contact us via e-mail/phone or interact with us on social media. We use these customer service records to manage your queries or complaints effectively, for quality monitoring and to continually improve our services.

Legal basis:

Insofar as the purpose relates to the execution of a contract agreed with you or the provision of a service requested by you, the legal basis is Article 6 (1) b GDPR.

9. To informyouabout news related to events organized or services provided by us

We send newsletters, emails and other electronic notifications with promotional information (hereinafter referred to as “newsletter”) only with the consent of the recipient or legal permission. If, as part of a subscription to a newsletter, the newsletter’s content is specified, it determines the extent of the user’s consent. Alongside our festival newsletter, we also publish a daily newsletter during the festival and the duration of Sofia Meetings.

To subscribe to a newsletter, your email address is sufficient. We also give you the option to provide your first and last name. This information is solely used for personalization purposes.

The use of the email marketing service provider, the implementation of the statistical surveys and analyses as well as the recording of the subscription process, comply with our legitimate interests in accordance with Art. 6 Section 1(f) of the GDPR. Our interest focusses on a user-friendly and secure newsletter system, which serves our commercial interests and, at the same time, meets the expectations of the users.

You may cancel your newsletter subscription, i.e. you withdraw your consent, at any time. You can find a link for the cancellation of newsletters at the end of each newsletter. You can also unsubscribe by writing to office@siff.bg

Legal basis:

If you have given consent to the processing of your data as described above for sending you news and information about events and services, the legal basis is Article 6 (1) a GDPR (Consent).

10. To fulfil our legal obligations

We use your personal data to ensure we comply with any requirements imposed on us by law or court order, including disclosure to judicial or administrative authorities.

Legal basis:

Where we process your personal data on the basis of legal specifications, the legal basis is Article 6 (1) c GDPR.

INTEGRATION OF THIRD-PARTY SERVICES AND CONTENT

On our websites, we may make available third-party content such as YouTube videos or graphs. For online users to access these services and content, the third-party providers of these online services must have their IP address. It follows that, unless these third-party providers know your IP address, they cannot send the content in question to your browser. Accordingly, the IP address must be provided for you to access the content. On our websites, we endeavour to offer only content from third-party providers that collect your IP address for the sole purpose of publishing content.

Google Analytics

Our websites use Google Analytics, a website analysis service provided by Google Inc. 1600 Amphitheatre Parkway, Mountain View, CA 94043, U.S.A. ("Google"). Google Analytics uses cookies, which are text files installed on your computer, to help analyze the way online visitors use the website. The data generated by the cookies concerning your use of the website is generally transmitted to and stored by Google on servers located in the United States.

Google will use this information to evaluate your use of the website, compile reports on website activity for its publisher and provide other services related to the website's activity and Internet usage. Google will not attempt to match your IP address transmitted for Google Analytics and any other data held by Google.

You can prevent the information collected by the cookie in relation to your use of the websites (including your IP address) from being transmitted to Google and analysed by Google, by downloading and installing the browser plug-in available here: https://tools.google.com/dlpage/gaoptout?hl=en

Google Analytics data security and confidentiality, available here: https://support.google.com/analytics/?hl=en#topic=

YouTube

We incorporate YouTube videos into some of our websites. The operator of the corresponding plug-in is YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. When visiting a website by using the YouTube plug-in, a connection to the YouTube servers is established. In the process YouTube is notified which sites you are visiting. If you are logged into your YouTube account, YouTube can identify your personal surfing behaviour. You can prevent this by logging out of your YouTube account beforehand.

When a YouTube video is started, the provider uses cookies which collect information about user behaviour. If you have deactivated the storing of cookies for the Google Ad Program, these types of cookies will also be turned off when watching YouTube videos. However, YouTube still stores non-personal usage information in other cookies. If you would like to prevent this from happening, you must block the storing of cookies in your browser. You can find further information about the handling of user data in the privacy statement of YouTube at: https://policies.google.com/privacy?hl=en&gl=de

COOKIES

Please be aware that, when you visit our websites, cookies may be installed automatically on your browser.

Cookies are "information stored in the terminal equipment” and installed by a website on a user's device. Installing a "cookie" is akin to sticking a "label" on the online user's device.

If this label contains a unique identifier, the website can use this identifier to distinguish one online user from another, and so recognize the user on subsequent visits. It serves primarily as an identifier and cannot be run as code, nor carry a virus.

The purpose of cookies is to make your visit to our websites smoother and more user-friendly.

Our websites use the following cookies:

- temporary session cookies, which are erased as soon as you leave your browser or the website;

- permanent cookies, which remain on your device until they expire at the end of their lifetime or until you delete them with the help of your browser features.

The information collected by the Art Fest-installed cookies listed below undergo processing designed to:

- facilitate connections to our websites. The sole purpose of this processing is to make browsing our web pages easier, and the personal data in the cookies is not transferred by the Art Fest to third parties;

- measure and analyze website audience and traffic, and your browsing on our websites, mainly for the purposes of improving our services.

Any information collected by these cookies is kept only for the duration of use of the services offered by our websites and, in any event, for a period not exceeding 24 months.

Configuring cookies on different browsers:

If you would like to block cookies, your browser gives you the means to do so: you can decline to receive or save new cookies. However, if you configure your browser to automatically block cookies, you will no longer be able to use certain features of our websites.

While most browsers are configured by default to allow cookies to be installed, you can configure your web browser to enable or disable the installation and use of cookies, or you can choose which ones you want to allow, based on the cookie issuers. You can click on your browser's "Help" menu to find out how to adjust your cookie preferences.

You can also configure your browser to allow or disallow cookies, on a case-by-case basis, prior to their installation. You can also set your browser to regularly clear the cookies from your device. Do not forget to configure all the browsers on your different devices (tablets, smartphones and computers).

Because each browser is configured differently, you will find below the main websites offering help with configuring your browser:

- for Internet Explorer: http://windows.microsoft.com/fr-FR/internet-explor...

-for Safari: https://support.apple.com/guide/safari/manage-cookies-and-website-data-sfri11471/mac

for Chrome: http://support.google.com/chrome/bin/answer.py?hl=...

for Opera: http://help.opera.com/Windows/10.20/fr/cookies.htm...

You can usually control which cookies, if any, are stored on your device. At any time and at no cost, you can enter, or change, your preferences through the choices available in your browser software.

HOW LONG DO WE KEEP YOUR PERSONAL DATA?

We retain your personal data for such period as required or allowed to fulfil the purposes for which we process the data. Upon fulfilment of these purposes or in case we no longer have legitimate interest or legal basis for data processing (for example, when the consent for processing has been withdrawn), we will erase your personal data without undue delay.

The criteria that serve as grounds for determination of the period of retention of your personal data include: (а) the period for which we maintain commercial relations with you and provide you with our services, (b) the periods for data retention set forth in the legal regulations that apply to us, and (c) the period for which are required to retain your data for in connection to our participation and the protection of our rights and legal interests in court and administrative proceedings and the expiration of the respective limitation periods.

We will retain the personal data, contained in our accounting books, for the periods set forth in the Bulgarian Accounting Act.

THIRD PARTIES WE SHARE PERSONAL DATA WITH

We only share your personal data if this is allowed by law. We work particularly closely with certain service providers, for example with technical service providers or with logistics companies (e.g., postal companies). These service providers may generally only process your personal data on our behalf under special conditions. Where we use them to process orders, the service providers only receive access to your personal data in the scope and for the period required for provision of the relevant service.

If, within the framework of this Privacy Policy, we use content, tools or other means from any other provider and the indicated headquarters are situated in a third country, it can be assumed that the data transfer will take place in the country of the third-party provider’s headquarters. Third countries are those countries which are situated outside the European Economic Area and are not subject to EU-jurisdiction, i.e., countries in which the GDPR is not directly applicable. The transfer of personal data in third countries only takes place if there is an appropriate level of data protection or another form of legal permission.

The categories of recipients that process personal data on our behalf are:

accounting and audit companies that process personal data for the purposes of accounting and auditing our financial reports, as well as for complying with our obligations under the labor, tax, and insurance laws;
entities that provide services of the information society, hosting services, maintenance of our databases, software and applications that may contain data about you (those services that may sometimes be associated with access to your personal data to perform these tasks), social networks, web analytics and search engines, use of tools to refine user-generated content;
licensed postal operators and transport or forwarding companies when we deliver products you have ordered, as well as licensed suppliers of payment services for the purposes of processing payments from/to you;
video streaming platforms and participants registration platforms;
sponsors which are typically from within the industry. In certain situations, we may be required as part of our sponsor arrangement with that partner to provide basic details of attendees to them. They are not provided with this information so that they can communicate directly with you.
hotels, in the cases where we cooperate with the accommodation of the guests of the festival and Sofia Meetings;
state authorities to which we are legally obliged to provide your personal data, such as courts or administrative bodies performing regulatory, supervisory, or other similar functions (for example the Consumer Protection Commission, the personal data Protection Commission, the Competition Protection Commission, as well as other competent authorities that are legally allowed to collect and process personal data).

HOW IS YOUR PERSONAL DATA PROTECTED?

We have put in place appropriate organizational and security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know such data. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

YOUR RIGHTS IN RESPECT TO YOUR PERSONAL DATA PROCESSING

At all times during the period of processing of your personal data, you have certain rights that are listed below.

Right of access - you have the right to request a free copy of the personal data that we hold about you.
Right to rectification – if you find out that the personal data we process are inaccurate and/or incomplete, you can ask us to rectify and/or complete them.
Right to erasure (also known as the Right to be Forgotten) and the Right to restriction of processing – you have the right to request that we stop processing, or delete, all your personal data that we hold.
Right of objection - when we process your personal data based on our legitimate interest, you have the right to object to such processing. Moreover, you have the right to object at any time to the processing of your personal data for marketing and advertising purposes.
Right to data portability – when we process your personal data based on your consent or in order to perform any contractual obligations we have, you have the right to ask us to electronically move, copy or transfer your personal data in a machine-readable format.

The above rights may be limited in some circumstances, for example, if fulfilling your request would reveal personal data another person, if you ask us to delete information which we are required to have by law, or if we have compelling legitimate interests to keep it. We will let you know if that is the case.

You can exercise your rights under this Policy and the General Data Protection Regulation by calling us or sending us an email describing your specific request. If possible, your request shall be signed by hand or with a qualified electronic signature. If you are not able to sign your request in one of the aforesaid ways, we may ask you to provide additional information in order to identify you. You may exercise part of your rights as data subject through your profile with the Website where you can amend or delete the personal data you have provided us with.

Right to complain

If you believe that we process your personal data in a way that does not comply with the applicable law, you have the right to file a complaint to the competent authority. You can contact the supervisory authority with jurisdiction at your place of residence or your country or the supervisory authority with jurisdiction at our domicile.

The competent authority in the Republic of Bulgaria is the Personal Data Protection Commission with address:

Sofia, 1592

2, Prof. Tsvetan Lazarov Blvd.

tel.: 02/915 – 3518

Email: kzld@cpdp.bg

HOW TO GET IN TOUCH

On all matters related to the processing of your personal data or exercising your rights, you can contact us the following way:

Via email, by sending an electronic message to office@siff.bg