Privacy Policy
Obligatory Information on the Individuals’ Rights to Protect
Personal Data
Information on the Company Processing Your Data:
Name: Kaliakra Golf Foundation
UIC/BULSTAT: 176614233
Headquarters and management address: Municipality of Balchik 9600, Lighthouse Golf Resort,
Quarter Lake No 61.
Mailing address: Municipality of Balchik 9600, Lighthouse Golf Resort, Quarter Lake No 61
Phone: +359 882060586
E-mail: kaliakragolf@abv.bg
Website: www. kalikaragolf.com
Information on the Competent Supervisory Authority for the Personal Data Protection
Name: Commission for Personal Data Protection
Headquarters and management address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592
Mailing address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592
Phone: 02 915 3 518
Web page: www.cpdp.bg
The Kaliakra Golf Foundation (hereinafter referred to as “the Administrator” or the “Company”)
carries out its activities in accordance with the Personal Data Protection Act and Regulation (EU)
2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural
persons with regard to the processing of personal data and on the free movement of such data. This
information is intended to inform you of all aspects of the processing of your personal data by the
Company and the rights you have in relation to such processing.

Reason for Collecting, Processing and Storing Your Personal Data
Art. 1. The administrator collects and processes your personal data in connection with the use of the
online store www.capekaliakraopen.com and the conclusion of contracts with the company on the grounds of
art. 6, para. 1, Regulation (EU) 2016/679 (GDPR), and in particular on the following grounds:
Your consent as a client is explicitly obtained;
Execution of the obligations of the Administrator under contract with you;
Compliance with a statutory duty applicable to the Administrator;
For the purposes of the Administrator’s or a third party’s legitimate interests;
Objectives and Principles in Collecting, Processing and Storing Your Personal Data

Art. 2. (1) We collect and process the personal data you provide to us in connection with the use of the
online store and the conclusion of a contract with the company, including for the following purposes:
creating an account and providing full functionality in using the online store;
concluding and executing a distance contract;
individualisation of a party to the contract;
accounting purposes;
statistical purposes;
protection of information security;
ensuring the fulfillment of the contract for the provision of the respective service.
sending a newsletter at your request;
(2) We comply with the following principles when processing your personal data:
lawfulness, good faith and transparency;
limitation of the purpose of processing;
relevance to processing goals and minimization of data collection;
accuracy and topicality of the data;
restriction of storage in order to achieve the objectives;
integrity and confidentiality of processing, and ensuring an adequate level of security of personal
data.
(3) When processing and storing personal data, the Administrator may process and store personal data in
order to protect its legitimate interests:
fulfilling its obligations to the National Revenue Agency, the Ministry of Interior and other state
and municipal authorities.
What Kind of Personal Data Our Company Collects, Processes and Stores
Art. 3. (1) The Company carries out the following operations with the personal data you provide for the
following purposes:
Registration of an online store user and execution of a distance sales contract – the purpose of
this operation is to create an account for the use of the online store for the purchase of goods and
services and the provision of contact data for the delivery of purchased goods. The registration and
creation of an account for using the online store is not an obligatory step in providing the service
and it is accessible to a significant extent without the creation of an account.
Conclusion of the impact assessment: On the basis of the impact assessment carried out, the
operation “Registration of an online store user and the execution of a distance sales contract” is
eligible for carrying out and provide sufficient guarantees to protect the rights and legitimate
interests of the data subjects in accordance with GDPR requirements.
Conclusion and execution of a commercial transaction with a client or a partner – the purpose
of this operation is to conclude and implement a contract with a trading partner or a client and its
administration. Given the limited scope of the collected personal data and the fact that part of it is
collected from publicly available sources, carrying out an impact assessment of the operation is
not required.
Sending a newsletter – the purpose of this operation is to administer the newsletter sending
process to clients who have declared they wish to receive. Given the limited scope of personal
data collected, carrying out an impact assessment of the operation is not required.
Exercising a right of withdrawal or a claim – the purpose of this operation is to administer the
process of exercising the right of withdrawal or claim by the client. Given the limited scope of
personal data collected, carrying out an impact assessment of the operation is not required.

(2) The administrator shall process the following personal data and information for the following
purposes and on the following grounds:
Your individualized data (email, name, etc.)
Purpose for which data is collected: 1) Making a connection with the user and sending
information to him/her, 2) For the purpose of registering a user in the online store, and 3)
For sending a newsletter.
Reason for processing your personal information – By accepting the General Terms and
Conditions and registering in the online store or placing order without registration, and
upon entering into a written agreement, a contractual relationship is created between the
Administrator and you, on which ground we process your personal data – Art. 6, para. 1, b.
(b) GDPR. Your data for sending a newsletter is processed at your explicit consent – Art. 6,
para. 1, b. (s) GDPR.
Delivery details (names, phone, address, etc.)
Purpose for which data is collected: Execution of obligations of the Administrator under
a sales and delivery contract of purchased goods.
Reason on the processing of your personal data – By accepting the General Terms and
Conditions and registering in the online store or placing order without registration or upon
entering into a written agreement between the Administrator and you, a contractual
relationship is created, on which ground we process your personal data – Art. 6, para. 1, b.
(b) GDPR.
Additional data provided by you – If you want to add information to your account, you can fill
in the name, surname, phone number.
Purpose for which data is collected: Adding user’s information to his/her user account.
Grounds for data processing: You have explicitly given consent to process your personal
data for one or more specific purposes – 6, para. 1, b. (a) of GDPR at the time of
registration in the online store. The provision of this data is not required for registration in
the online store.

(3) The Administrator does not collect or process any personal data related to the following:
reveal racial or ethnic origin;
reveal political, religious or philosophical beliefs, or membership of trade unions;
genetic and biometric data, health data, or data on sexual life or sexual orientation.
(4) The personal data are collected by the Administrator from the persons to whom they refer.
(5) The Company does not make any automated decision making with data.
Art. 4. (1) The Company carries out the following operations with the provided by you, as legal
representatives or agents of legal persons-trading partners, personal data for the following purposes:
Conclusion and execution of a commercial transaction: For the conclusion and execution of a
commercial transaction with a trading company, we process only the full names of the legal
representative or the person authorized by the company. Conclusion of the Impact Assessment:
In view of the small volume of individuals whose data are being processed and given the limited
amount of personal data collected, the conduct of an impact assessment is not necessary for the
current operation.
(2) The personal data are collected by the Administrator from the persons to whom they refer also from
the Commercial Register to the Registry Agency.
(3) The Company does not make any automated decision making with data.
Art. 5. The Аdministrator can use the so-called “Cookies” for the purpose of delivering full functionality
on the website, improving user experience, statistical purposes, facilitated access, etc. that you agree to
using our website. You can control and/or delete “Cookies” by the settings of the browser you use at any
time. “Cookies” are not personal data and are not used to identify visitors and users of the online store.

Term of Storage of Your Personal Data
Art. 6. (1) The Administrator keeps your personal data for no longer than the existence of your online
store account. After deleting your account, the Administrator takes the necessary care to erase and destroy
all your data without undue delay or to anonymize it (i.e., to bring it in a form that does not reveal your
personality).
(2) The Administrator processes your personal data that you provided when placing an order without
registration in the online store until the order is completed, unless you have given your explicit consent
when placing your order to process your data for the purpose of improving the service, providing
recommended content for you, individual terms, promotions, and for statistical purposes.
(3) The Administrator shall store your personal data provided in connection with online orders for a
period of 5 years for the purpose of protecting the legal interests of the Administrator in legal or
administrative disputes with online store users.
(4) The Administrator shall notify you in case the data storing period is required to be extended in order
to comply with a statutory obligation or with respect to the legitimate interests of the Administrator or
otherwise.
(5) The Administrator keeps the personal data that they need to keep under the applicable legislation for
the relevant term, which may exceed the life of your online store account or until the order is completed.
Art. 7. The Administrator keeps personal data on the legitimate representations of his/her trading partners
for the term of the contract execution, to respect the legitimate interests and legal obligations of the
Administrator, which term may exceed the term of the concluded contract.
Transmitting Your Personal Data for Processing
Art. 8. (1) The Administrator may, at his/her own discretion, transmit some or all of your personal data to
personal data processors for the fulfillment of the processing purposes you have agreed to, subject to the
requirements of Regulation (EU) 2016/679 (GDPR).
(2) The Administrator notifies you in case of intent to transfer some or all of your personal data to third
countries or international organizations.
Your Rights in Collecting, Processing and Storing Your Personal Data
Withdrawal of Consent to Process Your Personal Data
Art. 9. (1) If you do not want your personal data to be processed for marketing purposes and receive a
newsletter, you may at any time withdraw your consent to processing by completing the consent
withdrawal form in Annex No1 or by a free text request, and send it to us by email.
(2) Once we have received your request, we will send you to the email you have provided for newsletters
and advertising messages, detailed instructions for your verification as a newsletters recipient and a
personal data subject, for which withdrawal of consent has been requested.
(3) Withdrawal of consent does not affect the lawfulness of the personal data processing that the
Administrator has performed so far.
Right of Access
Art. 10. (1) You have the right to request and obtain from the Administrator a confirmation that personal

data relating to you is processed by sending a request in free text on the email.
(2) You have the right to access the data relating to you as well as information relating to the collection,
processing and storage of your personal data.
(3) Once we receive your request, we will send you to the email you used to register or place orders in the
online store, detailed instructions on your verification as a personal data subject, for which access has
been requested.
(4) After the verification, according to para. 3, the Administrator provides you with a copy of the personal
data processed about you in electronic or other appropriate form upon request .
(5) The provision of access to the data is free of charge, but the Administrator reserves the right to impose
an administrative fee in the event of recurrence or excessive demands.
Right to Rectification or Adding Information
Art. 11. (1) You may at any time rectify or add information in the inaccurate or incomplete personal data
related to you using the “Edit Account” option.
(2) You may rectify or add information in the inaccurate or incomplete personal data relating to you
directly using your website account or by sending a request to the Administrator on the email through the
form in Annex No4 or by a free text request.
Right to Delete (“right to be forgotten”)
Art. 12. (1) You have the right to ask the Administrator to delete some or all of the personal data relating
to you, and the Administrator has the obligation to delete them without undue delay when any of the
following reasons exists:
personal data are no longer necessary for the purposes for which they were collected or otherwise
processed;
you withdraw your consent on which the processing of the data is based and there is no other legal
basis for the processing;
you object to the processing of your related personal data, including for the purposes of direct
marketing, and there are no legitimate grounds for the processing that will take precedence;
personal data has been treated illegally;
personal data must be deleted in order to comply with a legal obligation under EU law or the law
of a Member State that applies to the Administrator;
personal data have been collected in connection with the provision of information society services.
(2) The Administrator shall not be obliged to delete the personal data if he/she keeps them and processes
them :
for the exercise of the right to freedom of expression and the right to information;
to comply with a legal obligation that requires treatment provided for under EU law or the law of
the Member State that applies to the Administrator or for the performance of a task of public
interest or the exercise of official authority conferred on him;
for reasons of public interest in the field of public health;
for purposes of archiving in the public interest, for scientific or historical research or for statistical
purposes;
for the establishment, exercise or protection of legal claims.
(3) In order to exercise your right to be forgotten, you must email your request for your personal data to
be erased that the Administrator processes by completing the form in Annex No 2 or by free text request,
then the Administrator will send to the email you used to register or place orders in the online store,

detailed instructions for your verification as an online store user and a personal data subject, for which a
request for deletion have been made.
(4) Once we have verified the identity of the person making the request and the person to whom the data
relate in accordance with your instructions, we will delete all data we process for you in accordance with
par. 3.
(5) If there is an order by you we are currently processing, the earliest point at which you may want “to be
forgotten” is when you successfully complete your order.
Right of Restrict Processing
Art. 13. You have the right to require the Administrator to restrict the processing of your related data by
sending us a request in free text on the email when:
you contest the accuracy of personal data for a period that allows the Administrator to verify the
accuracy of personal data;
processing is illegal, but you do not want personal data to be erased but only their use to be
restricted;
The Administrator no longer requires personal data for the purpose of processing, but you require
them to establish, exercise or protect your legal claims;
You have objected to the processing pending verification that the legal grounds of the
Administrator have an advantage over your interests.
(2) After we receive your request, we’ll send you to the email you used to register or place orders in the
online store, detailed instructions for your verification as an online store user and a personal data subject,
for which a request to restrict processing has been made.
(3) After the verification under para. 2, the Company will stop processing your data, but will not remove
the posts you made in the online store, if any.
Right to Data Portability
Art. 14. (1) If you have consented to the processing of your personal data or the processing is necessary
for the execution of the contract with the Administrator or if your data is processed in an automated
manner, you may:
ask the Administrator to provide you with your personal data in a readable format and transfer it to
another administrator;
ask the Administrator to directly transfer your personal data to an administrator you provide when
it is technically feasible.
(2) You may exercise the right of data portability by sending us by e-mail a completed form according to
Annex No3 or a request in free text, after which the Administrator will send to the email you used to
register or place orders in the online store, detailed instructions for your verification as an online store
user and a personal data subject for which a portability request has been made.
(3) After the verification under para. 2, the Company sends the data it processes for you in the XML
format to your name.
Right to Receive Information
Art. 15. You can ask the Administrator to inform you of all disclosed recipients to whom personal data
for which correction, deletion, or restriction of the processing has been requested. The Administrator may
refuse to provide this information if this would not be possible or would require disproportionate effort.

Right to Object
Art. 16. You may object at any time against the processing of personal data by the Administrator that
relates to you, including if it is being processed for profiling or direct marketing purposes.
Your Rights If Your Personal Data Security Has Been Violated
Art. 17. (1) If the Administrator detects a breach of security of your personal information that may pose a
high risk to your rights and freedoms, he/she shall notify you without undue delay of the violation and of
the measures taken or to be taken.
(2) The Administrator is not obliged to notify you if:
has taken the appropriate technical and organizational protection measures with respect to the data
affected by the security breach;
has subsequently taken measures to ensure that the violation will not lead to a high risk for your
rights;
notification would require disproportionate efforts.
Individuals to Whom Your Personal Data is Provided
Art. 18. (1) For the purpose of processing your personal data and providing the service in its full
functionality and in view of your interests, the Administrator may provide the data to the following
personal data processors:
Processing personal data Purpose of the personal data processing
……………………………………….. ………………………………………….. ……………….
……………………………………….. ………………………………………….. ……………….
……………………………………….. ………………………………………….. ……………….
(2) Personal data processors shall comply with all legal and security requirements for the processing and
storage of your personal data.
Art. 19. The Administrator does not transfer your data to third countries.
Art. 20. In case of violation of your rights under the above or applicable data protection laws, you have
the right to lodge a complaint with the Commission for Personal Data Protection as follows:
Name: Commission for Personal Data Protection.
Headquarters and management address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592
Mailing address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592
Phone: 02 915 3 518
Web page: www.cpdp.bg
Art. 21. You may exercise all of your rights to protect your personal data through the forms enclosed with
this information. Of course, these forms are not obligatory and you can make your claims in any form that

contains a statement about it and identifies you as the data holder.
Art. 22. If the consent relates to a transfer, the Administrator shall describe the possible risks for the
transfer of data to third countries in the absence of a decision on adequate protection and appropriate
remedies.

Annex No 1
Consent Withdrawal for Processing Purposes
Your name * : …………………….
Your e-mail you used in the online store* : …………………….
Contact details (e-mail) * : …………………….
To
Name: …………………….
UIC/BULSTAT: …………………….
Headquarters and management address: …………………….
Mailing address: …………………….
Phone: …………………….
E-mail: …………………….
Website: …………………….
I hereby withdraw my consent the personal data to be processed which I have provided for the purpose of
receiving a newsletter, advertising messages or other marketing material by being familiar with the
conditions for consent withdrawal in accordance with the Obligatory Information on the Individuals’
Rights for the Online Store Personal Data Privacy.
In case of violation of your rights under the above or applicable data protection laws, you have the right to
lodge a complaint with the Personal Data Protection Commission as follows:
Name: Commission for Personal Data Protection.
Headquarters and management address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592
Mailing address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592
Phone: 02 915 3 518
Web page: www.cpdp.bg

Annex No 2
Request “to be forgotten” – to delete my personal information

Your Name * : …………………….
Your email with which you have signed up or used for online store orders * : …………………….
Contact details (e-mail) * : …………………….

To
Name: …………………….
UIC/BULSTAT: …………………….
Headquarters and management address: …………………….
Mailing address: …………………….
Phone: …………………….
E-mail: …………………….
Website: …………………….
Please all personal data you collect, process and store provided by me or by third parties that are related to
me according to the identified identification to be deleted from your databases.
I declare that I am aware that some or all of my personal data may continue to be processed and stored by
the Administrator for the purpose of performing her/his legal obligations.
In case of violation of your rights under the above or applicable data protection laws, you have the right to
lodge a complaint with the Commission for Personal Data Protection as follows:
Name: Commission for Personal Data Protection.
Headquarters and management address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592
Mailing address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592
Phone: 02 915 3 518
Web page: www.cpdp.bg

Annex No 3
Request for Personal Data Portability
Your Name * : …………………….
Your email with which you have registered or used for online store orders * : …………………….
Contact details (e-mail) * : …………………….
To
Name: …………………….
UIC/BULSTAT: …………………….
Headquarters and management address: …………………….
Mailing address: …………………….
Phone: …………………….

E-mail: …………………….
Website: …. …………………
I ask that all personal data relating to me that are collected, processed and stored in your databases to be
sent in a XML format to:
E-mail: …………………….
Administrator – receiving data: …………………….
Name : …………………….
Identification number (UIC, BULSTAT, registration number in CPDP) : …………………….
E-mail : …………………….
In case of violation of your rights under the above or applicable data protection laws, you have the right to
lodge a complaint with the Commission for Personal Data Protection as follows:
Name: Commission for Personal Data Protection
Headquarters and management address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592
Mailing address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592
Phone: 02 915 3 518
Web page: www.cpdp.bg

Annex No 4
Request for Data Correction
Your Name * : …………………….
Your email with which you have registered or used for online store orders * : …………………….
Contact details (e-mail) * : …………………….
To
Name: …………………….
UIC/BULSTAT: …………………….
Headquarters and management address: …………………….
Mailing address: …………………….
Phone: …………………….
E-mail: …………………….
Website: …………………….
Please the following personal data you collect, process and store provided by me or third parties that are
related to me to be corrected as follows:
Data to be corrected:

…………………………………………..
Please to be corrected as follows:
…………………………………………..
In case of violation of your rights under the above or applicable data protection laws, you have the right to
lodge a complaint with the Commission for Personal Data Protection as follows:
Name: Commission for Personal Data Protection
Headquarters and management address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592
Mailing address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592
Phone: 02 915 3 518
Web page: www.cpdp.bg