General personal data protection policy

GENERAL PERSONAL DATA PROTECTION POLICY

of " K3 Ultra Club for Sports and Tourism ", UIC 205427905

In this General Privacy Policy of “K3 Ultra Sports and Tourism Club”, UIC 205427905, in order to fulfill our obligations under the General Data Protection Regulation (Regulation 2016/679 of the European Parliament and of the Council, Regulation), we provide you with information regarding what personal data of yours may be collected and processed in the performance of the usual activities of K3 Ultra Sports and Tourism Club.

K3 Ultra Club for Sports and Tourism is an administrator of the personal data provided by you registering for participation in our events through our website at: and as such we want to help you understand for what purpose and how we can use your data.

Key concepts:

"Personal Data" means any information relating to an identified or identifiable natural person ("data subject");

'Special categories of personal data' means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as genetic data and biometric data that are processed solely for the purpose of identifying a natural person, as well as data on the state of health or data on the sex life or sexual orientation of the natural person;

'Health data' means personal data relating to the physical or mental health of a natural person, including the provision of health services that provide information about his or her state of health;

'Data subject' means a natural person who can be identified, directly or indirectly, in particular by an identifier such as name, identification number, location data, online identifier or by one or more characteristics specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

"Controller" means a natural or legal person, public authority, agency or other entity which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union law or the law of a Member State, the controller or the specific criteria for its determination may be laid down in Union law or in the law of a Member State; 

"Processor" means a natural or legal person, public authority, agency or other entity that processes personal data on behalf of the controller;

"Processing" means any operation or set of operations performed on personal data or a set of personal data by automatic or other means such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or other means by which the data is made available, arrangement or combination, restriction, deletion or destruction;

'Third party' means a natural or legal person, public authority, agency or other body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are entitled to process personal data;

"Recipient" means a natural or legal person, public authority, agency or other entity to which personal data is disclosed, whether a third party or not. Public authorities that receive personal data in the context of a specific investigation in accordance with European Union law or the law of a Member State are not considered to be 'recipients'; the processing of such data by those public authorities complies with the applicable data protection rules in accordance with the purposes of the processing;

"Restriction of processing" means the marking of stored personal data in order to restrict their processing in the future;

“pseudonymisation” means the processing of personal data in such a way that personal data can no longer be associated with a specific data subject without the use of additional information, provided that it is stored separately and is subject to technical and organisational measures to ensure that personal data are not linked to an identified natural person or to a natural person, identifiable; 

"Data Subject Consent" means any freely expressed, specific, informed and unambiguous indication of the will of the data subject, by means of a statement or a clear affirmative action, which expresses his/her consent for the personal data relating to him/her to be processed;

"Personal data breach" means an action/circumstance that results in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access to personal data that is transmitted, stored or otherwise processed;

'Supervisory authority' means an independent public authority established by a Member State. In the Republic of Bulgaria, this is the Commission for Personal Data Protection.

"Applicable Law" means legislation of the European Union and of the Republic of Bulgaria that is relevant to the protection of personal data.

Basic principles when working with personal data

• Personal data are processed lawfully, in good faith and in a transparent manner for the data subjects;
• Personal data is collected for specific and legitimate purposes and is not further processed in a way incompatible with these purposes;
• Personal data is accurate and updated if necessary.
• Personal data are deleted or corrected when it is found to be inaccurate or disproportionate to the purposes for which they are processed.
• Personal data shall be maintained in a form that allows the identification of the relevant natural persons for a period not longer than necessary for the purposes for which these data are processed;
• Personal data is processed in a way that ensures an appropriate level of security, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage;

How do we collect your data?

We use a variety of methods to collect data from and about you, including by:

Direct communication: you may provide us with your personal and contact information by filling out forms on this website, or by corresponding with us by phone, e-mail or otherwise. This includes personal data that you provide when you create a user profile on our website (if technically possible), register for a service or publications, participate in a contest or survey and/or comment or rate our news and galleries.

Automated technologies: while you use our website, we may collect data about your equipment or behavior in an automated manner. We collect this data using a variety of technologies, including "internet cookies".

INTERNET COOKIES are small files with information that are stored in your Internet browser (data about the language used, connection time, visited websites) or hard drive when you visit the site. You can change the settings of your internet browser so that it refuses all or some Internet cookies, does not store cookies or deletes cookies that have already been stored. K3 Ultra Club for Sports and Tourism is not responsible if the Internet browser you use does not support the functions for controlling the use, refusing to store or delete stored cookies. We draw your attention to the fact that if you share the use of your device with others, it is also possible to change the personalized nature of the operation of cookies.

Third parties or publicly available sources: We may obtain your data through a variety of third parties and publicly available sources, including analytics service providers such as Google for example and publicly available sources that provide access to your data, including contact information.

What personal data we do collect about you?

In connection with your registration for participation in our events through our website at: :

• Your names as written on your ID
• Site username or similar identifier
• Date of birth
• Gender
• Email address
• Phone number
• Size, in case of requested T-shirt
• Telephone number and name of the emergency contact person provided by you.

In connection with your admission to our sports events, we collect health data in one or more of the following ways:

• Data provided by you personally by filling in the "Health Questionnaire"
• Medical certificate issued by a competent medical professional
• Medical statement by a competent medical professional from an on-site medical examination

Data related to the payment of your participation in our sports events:

• Email address
• Phone number
• Customer number
• Invoicing address
• Unique Civil Number or Personal Number of a Foreigner
• Information related to the technical means of payment
• Service amount / fee

In connection with reporting your activity and reflecting the results/ranking during our sports events:

• Your names as written on the registration form
• Date of birth
• Gender
• Your photo/video image taken during the usual course of the sports event.

In connection with documenting the organization of sports events, informing the public, establishing violations, applying for sponsors and before institutions:

• Your names as written on the registration form
• Your photo/video image taken during the usual course of the sports event.

What personal data we do NOT collect about you?

K3 Ultra Club for Sports and Tourism does NOT collect or process data revealing your race or ethnic origin, political opinions, religious or philosophical beliefs or membership in trade unions, genetic data, biometric data for the purpose of uniquely identifying an individual, data regarding sex life or sexual orientation.

For what purposes will we process your data?

The information provided by you will be used for the organization and conduct of sports events and the fulfillment of the legal obligations of K3 Ultra Club for Sports and Tourism, related to the applicable legislation:

• Registration for participation in our sports events.
• Issuance of an invoice for registration for participation in sports events.
• Preparation of accompanying materials, including, but not limited to: a starter pack with a T-shirt according to your requested size, bib number and others.
• Contacting you to send important messages related to competition rules, in case of changes in the program, conditions for participation or those that would hinder the implementation of the planned activities or in case of need for additional and/or clarifying information.
• Registering your health status before starting the planned activities, part of the sports event.
• Contacting a Contact Person provided by you, in case of need.
• Tracking your activity during the sports event, reporting results and forming a ranking.
• Announcing the achieved results and ranking during the sports event, publishing results and ranking in the communication channels of K3 Ultra Club for Sports and Tourism, including social media.

On what basis we process your personal data?

The table below contain the categories of personal data that can be collected and processed, as well as the basis for their processing.

With whom we can share your personal data?

K3 Ultra Club for Sports and Tourism respects and cares about the confidentiality of your personal data. In compliance with the legal requirements, confidentiality of information, written agreement between the parties and appropriate measures to protect data security, it is possible for K3 Ultra Club for Sports and Tourism to provide your data to the following persons:

• Primo Account Ltd., which needs one, for the performance of the administration of financial and accounting obligations of K3 Ultra Club for Sports and Tourism.
• iRun Sports Club, which is necessary for them to providing the possibility for registration for sports events.
• Generali Insurance JSC, who need one, for the conclusion and administration of insurance "General Civil Liability" and group insurance "Accident of Athletes" of the participants in a sports event organized by K3 Ultra Club for Sports and Tourism.
• ELECTROINVEST TRADE Ltd., which needs one, to perform their functions related to time-reporting during the sports event, administering the results and forming and announcing the ranking of the sports event.
• Association "First Aid Academy" and "AGPSIPSМ Dr. Taralovi Ltd.", which needs one, to perform their functions related to conducting preliminary medical examinations and providing medical care, if necessary, during the sports event and its accompanying events.
• DIEM 2 Ltd. that need one to provide sportswear.

Such sharing of personal data is carried out only if there is a justified need for this, only to the minimum extent necessary for the fulfillment of the intended function by the recipient and on the basis of a written agreement for the recipients to provide an adequate level of protection.

We may share your personal data with national and/or European regulatory administrative authorities on the basis of a legal authority to request and receive such information, as well as other public authorities in cases provided for by law, in connection with the fulfilment of their legal obligations or in connection with legal proceedings.

• How long do we keep your personal data?

K3 Ultra Club for Sports and Tourism stores your personal data for a period corresponding to the need to achieve the purposes for which it was collected. It should be noted that in certain cases, longer storage may be required or permitted by law. In this case, K3 Ultra Club for Sports and Tourism will store your data in accordance with these statutory deadlines.

The criteria used by K3 Ultra Club for Sports and Tourism to determine the storage periods include:

• For how long the data is needed so that K3 Ultra Club for Sports and Tourism can fulfill the purposes for which the data was collected and processed;
• Is there a legal obligation or other legal or regulatory basis for the storage of personal data? Examples of such obligations and grounds are: provisions for mandatory storage of data in documents, provisions establishing limitation and limitation periods for the exercise of rights, orders from state data retention authorities.
• Is there a need to store the data for the purposes of administrative or judicial proceedings, the protection of legitimate interests or for the purposes of proceedings to examine the requests of the data subject.

What we do NOT do with your data?

K3 Ultra Club for Sports and Tourism does NOT process personal data for the purposes of direct marketing and does NOT perform profiling.

"K3 Ultra Sports and Tourism Club" will NOT use your personal data for purposes other than those described above.

K3 Ultra Club for Sports and Tourism does NOT sell your personal data to third parties.

K3 Ultra Club for Sports and Tourism does NOT transfer your personal data to countries outside the European Union.

• Your rights in relation to your personal data

According to the Regulation, data subjects have the following rights regarding their personal data:

• Right of access;
• Right to rectification;
• Right to request restriction of processing;
• Right to erasure (right to be forgotten);
• Right to data portability;
• Right to object to the processing of personal data;
• Right to object to personal data for direct marketing purposes
• The right of the data subject not to be subject to a decision based solely on automated processing, regardless of whether such processing also includes profiling.
• Right of access

Upon request by the data subject to K3 Ultra Club for Sports and Tourism, it provides the following information:

• whether or not the subject's personal data is processed;
• a copy of the subject's personal data, which are processed by K3 Ultra Club for Sports and Tourism, in cases where such are processed;
• information on the data processed.

In case K3 Ultra Club for Sports and Tourism processes personal data of the subject, it provides the following information regarding the processed personal data:

• the purposes of the processing;
• the recipients or categories of recipients to whom the personal data are or will be disclosed;
• where possible, the envisaged period for which the personal data will be stored and, if this is not possible, the criteria used to determine that period;
• the existence of the right to request the rectification or erasure of personal data or restriction of the processing of personal data relating to the data subject, or to object to such processing;
• the right to complain to a supervisory authority;
• where personal data are not collected from the data subject, any available information about their source;

Upon request by the subject of personal data, K3 Ultra Club for Sports and Tourism may provide a copy of the personal data that is being processed.

The exercise of the right of access of the data subject should not adversely affect the rights and freedoms of third parties - natural and legal, as well as lead to a violation of an obligation of K3 Ultra Club for Sports and Tourism, defined in a normative act.

Therefore, when providing a copy of the personal data, K3 Ultra Club for Sports and Tourism excludes the following information:

• personal data of third parties, unless they have expressed their explicit consent to this;
• data that constitutes trade secrets, intellectual property, in particular on copyright for software protection, or confidential information;
• other information that is protected and should not be disclosed in accordance with the relevant regulatory provisions.
• Right to rectification

In case of a request submitted by the subject of personal data for correction of personal data related to him/her, which are inaccurate or incomplete, without undue delay, K3 Ultra Club for Sports and Tourism does the following:

• Checking whether or not it processes personal data of the subject who submitted the request;
• Checking whether the specific data for which the request for correction has been submitted is being processed;
• Checking whether there are inaccuracies and/or incompleteness in the processed data;
• In the presence of inaccuracies, correction of data in accordance with those indicated as correct/correct, and in the presence of incompleteness, the same should be supplemented/filled in, including by adding a declaration, taking into account the purposes for which the personal data were collected and processed.
• Right to restriction of processing

In case of a request submitted by the subject of personal data to restrict the processing of personal data, K3 Ultra Club for Sports and Tourism does the following:

• Checking whether or not it processes personal data of the subject who submitted the request;
• Checking whether the specific data for which the request for restriction of processing has been submitted is being processed;

In case the above conditions are met, the following conditions are checked, and in the presence of one of them, K3 Ultra Club for Sports and Tourism restricts the processing of personal data for which the request has been submitted:

• the accuracy of the personal data is disputed by the data subject, for a period that allows the controller to verify the accuracy of the personal data;
• the processing is unlawful, but the data subject does not want the personal data to be erased, but instead requests the restriction of their use;
• K3 Ultra Club for Sports and Tourism no longer needs the personal data for the purposes of processing, but the data subject requires them for the establishment, exercise or defense of legal claims;
• the data subject has objected to the processing on the basis of Article 21(1) of the Regulation. In this case, K3 Ultra Club for Sports and Tourism ceases the processing of personal data, unless it proves that there are compelling legitimate grounds for the processing, which take precedence over the interests, rights and freedoms of the data subject.
• Right to erasure (right to be forgotten)

In case of a request submitted by the subject of personal data for the deletion of personal data related to him/her, K3 Ultra Club for Sports and Tourism does the following:

• Checking whether or not it processes personal data of the subject who submitted the request;
• Checking whether the specific data for which the deletion request has been submitted is being processed;

In case the above conditions are met, a check is carried out for the presence of the following grounds:

• the personal data is no longer necessary for the purposes for which it was collected or processed;
• the data subject withdraws his/her consent on which the data processing is based and there is no other legal basis for the processing;
• the data subject objects to the processing pursuant to Article 21(1) of the Regulation and there are no legitimate grounds for the processing that prevail, or the data subject objects to the processing pursuant to Article 21(2);
• the personal data has been processed unlawfully;
• personal data must be deleted in order to comply with a legal obligation applicable to “K3 Ultra Club for Sports and Tourism";

In the presence of any of the above grounds, K3 Ultra Club for Sports and Tourism deletes the personal data for which the request has been submitted.

• The right to data portability

In case of a request submitted by the subject of personal data for portability of personal data related to him/her, which concern him/her or which the subject has provided to K3 Ultra Club for Sports and Tourism, the Club shall do the following:

• Checking whether or not it processes personal data of the subject who submitted the request;
• Checking whether the specific data for which the portability request has been submitted is being processed;

In case the above conditions are met, a check shall be made for the presence of the following grounds:

• Is there any processing carried out on the basis of the consent of the personal data subject;
• Is there any processing carried out on the basis of a contractual obligation;

In case any of the above grounds are met, K3 Ultra Club for Sports and Tourism shall provide the data for which the request has been submitted in a structured, widely used and machine-readable format.

The right to portability may not adversely affect the rights and freedoms of others. It is recommended that the data that fall within the scope of the satisfied request for portability are only personal data of the subject who submitted the request and therefore that they are provided by him knowingly and through active actions. The scope is recommended not to include data that is anonymous or does not relate to the data subject. Where technically feasible and at the request of the data subject, the specific personal data may be transferred to another controller designated by the data subject.

• Right to object

In case of an objection filed by the subject of personal data against the processing of personal data relating to him or which concern him, K3 Ultra Club for Sports and Tourism does the following:

• Checking whether or not it processes personal data of the subject who submitted the request;
• Checking whether the specific data for which the request for objection has been submitted is being processed;

In case the above conditions are met, a check is carried out for the presence of the following grounds:

• Is there any processing based on the need to perform tasks of public interest;
• Is there any processing based on the legitimate interests of K3 Ultra Sports and Tourism Club or a third party necessary for the fulfillment of certain purposes;

In the event that any of the above grounds is met, K3 Ultra Club for Sports and Tourism shall cease to process the data for which the objection to processing has been submitted, unless Club for Sport and Tourism K3 Ultra proves that there are compelling legal grounds for continuing the processing of the data, which take precedence over the interests, rights and freedoms of the data subject or for the establishment, the exercise or defense of legal claims of K3 Ultra Club for Sports and Tourism.

• Right to object to personal data for direct marketing purposes

In case of an objection filed by the subject of personal data against the processing of personal data concerning him for this type of marketing, which includes profiling, insofar as it is related to direct marketing, K3 Ultra Club for Sports and Tourism does the following:

• Checking whether or not it processes personal data of the subject who submitted the request;
• Checking whether the specific data for which the request for objection has been submitted is being processed;

In case the above conditions are met, the following actions are taken:

• Stops processing immediately, without further evaluation and condition
• Removes the subject from all marketing communication lists
• Implements technical and/or organisational measures to prevent future incorporation
• Right to human intervention in automated decision-making

K3 Ultra Club for Sports and Tourism uses technical means for automated decision-making, only for purposes related to automatic counting of time during the competition and formation of ranking.

In case of an objection filed by the personal data subject against automated decision-making without human intervention, K3 Ultra Club for Sports and Tourism does the following:

• Checking whether or not it processes personal data of the subject who submitted the request;
• Checking whether the specific data for which the request for objection has been submitted is being processed;

In case the above conditions are met, the following actions are taken:

• Termination of automated processing if it is based solely on automated means and has legal effects or significantly affects the subject.
• Providing human intervention in the event that the subject requests human intervention in the decision-making process. In this case, the administrator must:
• provide a person to review the case;
• re-evaluate the decision;
• provide a reasoned response.
• The controller must inform the subject of:
• the logic of the automated decision;
• the significance and expected effects of the processing;
• his right to challenge the decision.
• Procedure for exercising the rights of personal data subjects

Personal data subjects exercise their rights in relation to their personal data by submitting a written request for the exercise of the relevant right, in free text.

A request for exercising the rights of personal data subjects shall be accepted as follows:

• Electronically to the following email address:
• On site at the office of K3 Ultra Club for Sports and Tourism;
• By mail to the address of the headquarters of K3 Ultra Club for Sports and Tourism.

The request for the exercise of rights related to the protection of personal data shall contain the following information:

• Identification of the person – name, address, personal identification number/personal identification number/other similar identifier or other identification data of the respective natural person, determined by K3 Ultra Club for Sports and Tourism, in connection with the activity carried out by him/her;
• description of the request;
• preferred form of communication and actions under Art. 15-22 of Regulation (EU) 2016/679;
• signature, date of submission of the application and address for correspondence;
• The specific personal data to which the request relates;
• Request – a description of the request and other information, depending on the type of right being exercised;
• Method of providing the information and responding to the request – on paper or electronically.

In cases where K3 Ultra Club for Sports and Tourism has reasonable concerns regarding the identity of the natural person who submits a request for exercising the right, K3 Ultra Club for Sports and Tourism may request an additional information necessary to confirm the identity of the data subject.

If the purposes for which K3 Ultra Club for Sports and Tourism processes personal data do not require the identification of the data subject, K3 Ultra Club for Sports and Tourism is not obliged to maintain, obtain or process additional information in order to identify the data subject for the sole purpose of providing a response to the request for exercising rights.

In these cases, when K3 Ultra Club for Sports and Tourism is not able to identify the data subject, K3 Ultra Club for Sports and Tourism is not obliged to respond to the request on the merits. If possible, K3 Ultra Club for Sports and Tourism shall notify the subject of the impossibility to identify him and to provide a response to his request on the merits. K3 Ultra Club for Sports and Tourism proves the impossibility of identifying the subject.

In case the data subject provides additional information allowing his identification in order to exercise his rights under the Regulation, then K3 Ultra Club for Sports and Tourism considers his request on the merits.

The controller assists in the exercise of the rights of the data subject.

The information and communication that takes place with the data subject is provided in a concise, transparent, understandable and easily accessible form, in clear and simple language.

Where the request is submitted by electronic means, the information shall be provided by electronic means, if possible, unless the data subject has requested otherwise. The information may be given orally if the data subject has requested it, provided that the identity of the data subject has been proven.

K3 Ultra Club for Sports and Tourism shall provide information on the actions taken in connection with the received request for exercising the rights of the entities within one month from the date of receipt of the request.

If necessary, this period may be extended by a further two months, taking into account the complexity and number of requests from the data subject concerned.

K3 Ultra Club for Sports and Tourism shall inform the entity of any such extension within one month of receipt of the request, indicating the reasons for the delay.

In cases where requests for the exercise of the rights of the subjects are manifestly unfounded or excessive, especially due to their repetitiveness, K3 Ultra Club for Sports and Tourism may charge a reasonable fee based on the administrative costs for providing the information or refuse to respond to the request for exercising rights.

K3 Ultra Club for Sports and Tourism assesses on a case-by-case basis whether a request is manifestly unfounded or excessive.

Any requests of data subjects for the exercise of rights that have already been fully satisfied or which largely overlap with requests that have already been granted will be considered excessive, regardless of the periods and time intervals that have elapsed between individual requests, unless there has been a change in the data or other parameters of processing, after the first request has been granted. For example, in the event that a request is satisfied and a new request for exercising the same right follows, while no new information has been received in the meantime and no additional personal data of the subject is processed, then the request in question will be considered excessive due to its repetitiveness. based on the administrative costs of respecting it.

In case of refusal to provide access to personal data, K3 Ultra Club for Sports and Tourism justify its refusal and informs the data subject about his right to file a complaint with the CPDP and seek protection in court.

K3 Ultra Club for Sports and Tourism keeps a register of requests received from data subjects for the exercise of rights and the responses to them.

• Restrictions

The exercise of data subjects' rights may be restricted in order to ensure:

• national security;
• national dnefense;
• public order and security;
• the prevention, investigation, detection or prosecution of criminal offences or the execution of penalties imposed, including the prevention of and prevention of threats to public order and security;
• other important objectives of broad public interest, in particular important economic or financial interest, including monetary, budgetary and fiscal matters, public health and social security;
• the protection of judicial independence and judicial proceedings;
• the prevention, investigation, detection and prosecution of violations of codes of ethics in regulated professions;
• the protection of the data subject or the rights and freedoms of others;
• enforcement of civil law claims.

Contact information

You can contact K3 Ultra Club for Sports and Tourism at the following address:

4980 g. Zlatograd, ul. 9 Delyo Voyvoda Str.

Tel: +359 886 008 128

Email: k3ultrabg@gmail.com

• Entry into force and update

This document is subject to periodic review for relevance and adequacy and is updated as necessary.

When making updates, the changes should be published in a timely manner on our website at: .