PERSONAL DATA PRIVACY NOTICE
I. INTRODUCTION
IRIS Solutions OOD, UIC 204997709 (hereinafter referred to as “Iris“, “the Company” or “we“) is a legal entity, registered in the Bulgarian Commercial Register, with UIC 204997709, with registered office and management address in the city of Sofia, 111B Tsarigradsko Shose Blvd., Sofia Tech Park, Incubator Building, 1st floor, licensed to provide account information services in accordance with Article 4, item 7 and item 8 of the Bulgarian PSPSA, registered in the Register of Licensed Payment Institutions in the Republic of Bulgaria, administered by the Bulgarian National B; The Company is personal data controller within the meaning of the Personal Data Protection Act (PDPA) and collects, processes and stores your personal data under the terms of this Privacy Notice.
You can contact us at the following contact data:
Address: Sofia, 111B Tsarigradsko shose Blvd., Sofia Tech Park, Incubator Building
e-mail: bdo@irisbgsf.com
This Personal Data Privacy Notice (hereinafter referred to as the “Privacy Notice”) has been prepared and is based on the current Bulgarian and European legislation regarding personal data protection.
This Privacy Notice regulates the processing by Iris of personal data of Account Holders, who have entered into an agreement with SELFPAY SA in terms of processing of their Account Information and have given a valid Service authorization for initiating a request for facilitating and transfer of Account information from the primary Account Information controller to SELFPAY SA.
II. GENERAL PROVISIONS AND DEFINITIONS
The terms below have the following meaning for the purposes of this Privacy Notice:
“Account Information” means Account related unaggregated data, such as Account Holder`s name, Account number, balances, transaction history, etc., except for “sensitive payment data” as per art. 4, para. 12 of PSD2, generated and administered by an “account servicing payment service provider” as per art. 4, para. 17 of PSD2 as a primary data controller;
“Service” means facilitating of the transfer of Account Information from the primary Account Information controller to SELFPAY SA;
SELFPAY SA, with registered headquarters in Romania, Bucharest, 2nd District, no. 153-155 Dacia Blv, 7th floor, postal code 020057, incorporated under no. J40/9919/2009 with Trade Register, UIC 26067497, Fiscal attribute RO, registered, hereby represented by E-Pay Consulting SRL through Adrian Daniel Badeaherebyrecipient of the Service for further administration and use of the Account Information as per its arrangements with the Account Holder.
“GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
“Personal Data” means the information under section III, p. 1 to 3 herein below, as defined in Article 4, para. 1 of the GDPR (Regulation (EU) 2016/679).
III. COLLECTION OF PERSONAL DATA
We collect the following Personal Data about you with regard to the Service:
By giving a valid Service authorization hereunder, you express your informed and explicit consent to provide your Personal Data in order to be collected and processed by us. Comprehensive information about the use of Personal Data by us can be found in this Privacy Notice.
IV. PURPOSE OF PROCESSING
We use your Personal Data for the following purposes:
In the event that Iris plans to use your Personal Data for other purposes, we will notify you in advance and ask for your explicit consent.
V. GROUNDS FOR PROCESSING PERSONAL DATA:
We store your Account information only within the individual Account Holder’s session which is necessary to accomplish the particular Service and we do not have further access to this data. We shall provide your Account Information to SELFPAY SA when you initiate the Service through SELFPAY SA’s client Application or through the website of SELFPAY SA.
VI. SECURITY
Iris uses reasonable electronic, human and technical measures to protect Personal Data from loss, theft, alteration or misuse. However, keep in mind that even the best security measures cannot completely eliminate all risks.
VII. YOUR RIGHTS
Iris will provide you with information about the processing when we collect personal data from you, as well as through privacy notices such as this.
You have the right to access your personal data and details of how we process them. You can request details about the personal data that the Company holds about you by contacting us at e- mail: bdo@irisbgsf.com.
You have the right to rectify or request rectification of your personal data if it is inaccurate or incomplete.
Iris makes its best effort to keep the personal data processed accurate and up-to-date. However, we rely on our customers to make sure that some of the information which is related to them, is accurate and up to date. We encourage customers to notify Iris in case of any changes to their information (for example, by updating your account information).
You have the right to object to certain uses of personal data, such as direct marketing.
You have the right to request that we delete or remove personal data from our records when there is no good reason to continue processing them. Where personal data are still needed for lawful purposes, it will not be possible to delete this data, so some requests may be rejected.
You have the right to “block” the processing of personal data in limited circumstances. This right may be exercised:
This right applies only to personal data that is provided to us in a structured, widely used and machine-readable format and which we process on the basis of your consent or to enter into a contract with you.
The right to data portability allows individuals to reuse their personal data in different services; allowing them to move or copy data from one organization to another if they choose.
When we process personal data on the basis of your consent, the consent should be freely expressed, specific, informed and unambiguous, given through a statement or clearly confirmatory action. You have the right to withdraw your consent to the processing of your personal data at any time with a separate request addressed to Iris in the case of processing based on a given consent.
You have the right to lodge a complaint directly with the supervisory authority, the competent authority being the Commission for Personal Data Protection:
Commission for Personal Data Protection, Sofia, 1592, 2 Prof. Tsvetan Lazarov Blvd., tel: + 3592 / 91-53-518, E-Mail: kzld@cpdp.bg
In the event that you wish to exercise any of these rights, please contact us through the contacts provided in Section II of this Privacy Notice.
VIII. MISCELLANEOUS
Iris may update this Notice periodically by publishing a new version and all changes and additions to the Privacy Notice will be applied only after the publication of its current content.
Notwithstanding the above, we reserve the right to notify you at the email address you provide of changes to these policies. That is why you must always keep your contact details up to date.
If you have any questions or comments about this Privacy Notice, please contact us at bdo@irisbgsf.com.