Article 1. General provisions
Art & Therapy Institute Ltd. is committed to ensuring the confidentiality and protection of your personal data, in our capacity of a Controller of the personal data you provide to us.

The present Policy explains when and why we collect personal information (“personal information” and “personal data” are used as identical terms in the present Policy) about the people visiting our site and using our services, how we use such information, the terms and conditions under which we may disclose it to third parties and how we keep and protect it.

We may make amendments to and change this Policy at certain moments, so we ask you to make sure that you’ve read the current and effective Privacy Policy. Using our site and the rendered through it services, you agree to be bound by this policy. Any questions related to the Privacy Policy shall be e-mailed to info@artstherapyinstitute.bg .

Article 2. About the Controller
Arts & Therapy Institute LTD offers services in the sphere of the psychological consultation, training in various holistic and academic methods, book publishing, building children’s art shops, book distribution, etc. Management address: Sofia 1000, 65 Vitosha Blvd.

Article 3. How do we collect personal information from you
We receive your information when you use our site www.artstherapyinstitute.bg , for eample when you’re sending an inquiry or in the process during which you scroll through, order and use the provided on the site services.

Article 4. What type of personal information we collect
We collect only basic personal data for you, not including special categories of personal data (“sensitive data”). The personal information we collect may include the name, address, e- mail, telephone number, other data required under the Accountancy Act and other legal by- laws, as well as information regarding which webpages are visited and when.

Article 5.
Why do we need your personal data We need to know your personal data to enable us to provide the services, offered through the site, within the framework of effectuated agreement between us in relation to the data’s provision, as well as information which you have requested or for which you have granted your explicit consent. We will not collect personal data which we do not need for the above stated purposes.

Article 6. How is your personal information used
We may use your personal information for:

• providing you with the services you have requested, including for processing your orders and for performing our obligations, arisen out of the contractual relations between us in accordance with the General Terms and Conditions;
• providing new information directly related to a service you have requested
• answering your questions and inquiries and providing information you have requested, including support and help for solving matters arisen in relation to your inquiries;
• asking for your feedback and opinions regarding the provided by us services and products/trainings
• performing statistical and other analyses for improvement of our services;
• ensuring the protection of your interests in relation to the use of the site or our services;
• Informing you about changes in the general terms and conditions, the privacy policy or our services

Article 7. How long do we keep your information
We keep your personal data only to the extent and until this is required for the respective activity, for which they are provided, or as provided for in an agreement between us, in compliance with the requirements and terms for that, stipulated in the Accountancy Act, the tax laws and other effective legal by-laws in the Republic of Bulgaria.

The data you have provided to be used for marketing purposes are kept until you notify us that you no longer wish to receive the respective information from us.

After we have processed your personal data, we destroy them.

Article 8. Who has access to your information
We shall not sell, nor lease, neither disclose to and share for marketing purposes your information with any third parties.

We may disclose your information to third parties – service suppliers, subcontractors and other associated organizations only for the purpose of the implementation of tasks and the provision of services for you on our behalf.

Notwithstanding when we use third parties – service suppliers, we shall disclose only the personal information required for the provision of the service, and we have an agreement with the third party, requiring from that party to keep your personal data confidential and not to use them for marketing purposes.

We shall not disclose your information to third parties for their marketing purposes, unless you have asked for that, or such disclosure shall be done by virtue of a law, court order or for the prevention of frauds or other crimes.

We work with various third parties – service suppliers – to ensure for you high quality and reliable services. When you research such service or purchase it, the respective third party – service supplier – shall use your personal data to provide you with information and to perform the obligations thereof, which arise to that relation under agreements with them. In some cases they shall act as data controllers of your personal data, that’s why we recommend that you make yourself aware of their Privacy Policy. Such third parties – service suppliers – will share your information with us, and we’ll use it in accordance with the present Privacy Policy.

Your data will be disclosed to state and governmental authorities and bodies only in the legally stipulated cases and to the extent not exceeding the purpose for which they are demanded.

The Personal Data Protection Commission exercises the legal control over the processing of personal data and we are required to grant full access to the kept by us personal data books and registers according to the legal regulations.

Article 9. Where do we process your data
All personal data we possess are processed in Bulgaria, and for the hosting and maintenance purposes such information is located in Bulgaria. No third parties have any access to your personal data, unless the law provides for that.

Article 10. When do we contact you
You decide whether to receive or not information from us. We may contact you freely when and as far as this is required for the performance of the services you have requested, and of the obligations pursuant to an agreement between us for provision of new information, directly related to services you have requested, in response to your inquiry, for the purpose of protecting your interests in relation to your use of our site or our services, or by virtue of a legal requirement. We shall not contact you for marketing purposes via e-mail, telephone, through text messages or by mail, unless we have received your prior explicit consent to that regard, or the communication is directly related to you and meets the requirements of the General Data Protection Regulation (Regulation (EU) 2016/679).

Article 11. How you can receive access to, rectification or erasure of your personal data
At any time you are entitled to request from us:

• access to your personal data, collected in the process of provision and use of the services, including: confirmation whether we process your personal data, what are the categories thereof, the purpose of this processing, and the recipients to whom the data is disclosed, and a notification with a copy of your personal data, which are processed and the source thereof;
• rectification of the information you have provided to us, when it has become untrue or non-current, e.g. e-mail address or any other information;
• erasure or blocking your personal data, when the processing does not meet the requirements of the Personal Data Protection Act or of the General Data Protection Regulation (Regulation (EU) 2016/679);
• notifying of such rectification, erasure or blockage the third parties to whom your personal data have been disclosed, except when that is not possible or related to excessive efforts.

The requested by you action on the provision of access to, rectification, erasure or blockage of personal data shall be performed only in relation to your personal data. It shall be done free-of-charge.

To request access to, rectification, erasure or blockage of your personal data, we process, you have to send us a written request, which shall contain:
1. name, address and other data for identification of the respective physical person;
2. description of the request;
3. preferred form for provision of the information under article 28, paragraph 1;
4. signature, the date of sending the request and the mailing address;
5. notary certified power of attorney, when the request is sent by an authorized proxy. The request may be signed with an electronic signature as well. The request shall be sent to e-mail: info@artstherapyinstitute.bg We shall perform your request for access to, rectification, erasure or blockage within 14 days, in conformity with the legal requirements and exceptions to that relation. You will be notified for the decision for performing the required actions or the refusal for that in accordance with the legal requirements. This notification will be mailed to you with a return receipt, or delivered in person against signature.

Article 12. How you can file an objection or complaint against the processing of personal data
In the provided in the law cases you have the right to:

• object before us against the processing of your personal data, provided there are legal grounds for that; when the objection is justified, the personal data of the respective physical person will no longer be processed;
• object against the processing of your personal data for the direct marketing purposes;
• be notified prior to your personal data being disclosed to third parties for the first time or used on your behalf for the purposes under the previous item of this article, with you provided with the option and right to object to such disclosure or use.

If you want to file any complaint for the manner your personal data are processed, contact us at info@artstherapyinstitute.bg . If you are not satisfied with our response or you believe that we process your data in an unlawful way, you may turn to the competent personal data protection body – the Personal Data Protection Commission.

Personal Data Protection Commission
Address: Sofia 1592, 2 Professor Tsvetan Lazarov Blvd.
Tel.: 02/915 35 18, 02/915 35 15, 02/915 35 19, Fax: 02/915 35 25
e-mail: kzld@cpdp.bg
Web: www.cpdp.bg

Article 13. Available security measures for protecting your personal information against loss, misuse or change
When you provide us with your personal information, we undertake actions to ensure that it is securely and safely processed. When you visit a secure page, an off icon will appear at the bottom of the web browser.

Non-sensitive information (your e-mail address, etc.) is usually transferred through the internet, that’s why it may never be 100 % secure. To that relation, despite our efforts to protect your information, we’re unable to guarantee the security of information you send to us, and you do so on your own risk. After we receive your information, we assert maximum efforts to ensure it security in our systems.

Article 14. Profiling
We shall not use automated decision-making or profiling.

Article 15. Use of “cookies” The website www.artstherapyinstitute.bg uses “cookies” in view of ensuring consumer authentication and process for ordering digital and physical products.

Article 16. Links to other sites
Our website may contain links to other websites, administered by other organizations. The present Privacy Policy is applicable only for our site, therefore we encourage you to read the privacy recitals of the other websites you visit. We are not responsible for the other websites’ privacy policy, even if you use links from our site to visit them.

Moreover, if you have visited our website through a third party’s site, we shall not be responsible for the privacy policy and practices of the owners and administrators of the site of that third party, and we recommend that you check its privacy policy.

Article 17. Transfer of personal data outside Europe
As a part of the services we render the information you provide us with may be transferred to countries outside the European Union. Such countries may not have similar laws for personal data protection as Bulgaria. After you provide your personal data, you agree with such transfer, storage or processing. If we transfer your information outside the EU in that way, we shall undertake adequate security steps and measures to ensure the protection of your personal information in conformity with this Privacy Policy.

If you use our services when outside the EU, your information may be transferred outside the EU for you to receive such services.

Article 18. Review and update of the Policy
We review regularly the present Privacy Policy in order to ensure high quality and legal protection of your personal data. This Privacy Policy was last updated in March 2018 and it is in conformity with the requirements of the General Data Protection Regulation (Regulation (EU) 2016/679).