Privacy Policy of Rotary club Smolyan
during
ISFR Ski Week Pamporovo 2025
(‘Privacy Notice’)
We, at Rotary club Smolyan, strive to provide unique experience during ISFR Ski Week Pamporovo 2025 within the picturesque resort of Pamporovo. We highly value our privilege, but at the same time your security and privacy are extremely important issues to us. We act in the interest of all participants in the event and are transparent about how we process your personal data.
We strive to make our website and your portal to the event user-friendly and containing as much information as possible that may be of interest to you. We also take care of its safe use so that you are sure that your personal information and rights are protected. We have prepared the Privacy Notice to clarify our practices regarding the personal data we collect from you or about you on this site or through our applications, through written or oral communication with us when you visit any of our mini events, or from other sources.
In addition, the Privacy Notice gives you information on how to contact us, if you have questions about your personal data that we will gladly answer.
By using our web site and enrolling for the event and/or by accepting this Privacy Notice, such as in the course of registration for ISFR Ski Week Pamporovo 2025, you consent to the collection and use of personal data, as described in this Privacy Notice.
Please, note that this Privacy Notice does not apply to the way we process personal data on behalf of or as directed by third parties, such as other service providers, companies that organize or offer package event services, marketing partners, or corporate clients like banks, accountant offices, etc. Questions and answers:
Who are we?
Rotary club Smolyan, ID 30455, chartered on November 11, 1994, in District 2842, and entered in the Commercial Register kept by the Registry Agency with UIC: 120531148.
What do we do?
Rotary club Smolyan will be organizing the ISFR Ski Week Pamporovo 2025, being a host of many interesting mini events and trips throughout the Ski Week. In this aspect, we may need to processes personal data for the purpose of providing all events services (accommodation at the hotels; providing food at the restaurants or outside, providing sports and event services as per the schedule,providing transportation services by buses and/or vans of third parties, services for rental of skis, where practicable, restaurants and other facilities), as well as other services related to the participants whose data are processed (data subjects), or for the purpose of considering the possibility of providing such services to the data subjects. The provision of personal data by the individuals is voluntary. In case of refusal to provide personal data, Rotary club Smolyan will not provide the requested event services or perform the relevant commercial transaction, insofar as the processing of personal data is to the largest extent in fulfilmentof the club’s legal and statutory obligations. Contact details of Rotary club Smolyan
Address: 4700 Smolyan, Kiparis Alfa Hotel, 3A Bulgaria boul, E-mail: contacts@isfrpamporovo2025.com Telephone: +359888 275013 Website: https://www.isfrpamporovo2025.com
Personal information we collect
We collect personal information at any point of contact or interaction with our participants and in the performance of all aspects of preparation for the event. There is no way to help you book your stay at ISFR Ski Week Pamporovo 2025 or use any of the services we provide or events we organize, if you do not provide us with information. Therefore, when you enrol for the participation in the event, we request certain information from and about you. This personal information may include: your name, mailing address, email address, IP address, telephone number, information related to your booking or stay; participation in a membership program or to a Rotary club; participation in a contest or event; information related to the purchase and receipt of products or services; personal characteristics, nationality; travel history; payment information such as your payment card number and other information about it, as well as authentication information and other details for invoicing and payment account related to mobile payments; guest preferences; communication and marketing preferences; groups you are connected with when staying at hotels; information provided for membership programs and account creation; other type of information that you have chosen to provide us or we may obtain for you.
We may request data on height, weight, gender, age, foreign language proficiency, related to the provision of the service for ski equipment rental and/or ski school if so requested.
In addition, we collect other personal information in certain cases, such as:
Surveys: We may ask you for demographics and other personal data in user surveys.
Completing the surveys is voluntary - we process the information received from you based on your consent and in support of our business interests, including marketing, service improvements and analyses.
Collecting information at the site:
When booking your participation at ISFR Ski Week Pamporovo 2025 and staying at any of the hotel properties, we will process your name, address, contact details and details of your stay (day and time of arrival and departure, vehicle information, and travel and stay information) based on our contractual relationship with you. We also process such data for our business interests, including marketing, service improvement, analysis and personalization of services.
We collect additional personal information before or during the check-in /accommodation at the hotels such as Personal ID Number/Alien’s Personal Number, name, date of birth, gender, nationality, ID Card number or valid national identity document, country issuing the identity document, in order to comply with legal obligations under the Tourism Act (TA) and Foreigners in the Republic of Bulgaria Act (FRBA).
In the hotels provided for the event, it is often used an internal video surveillance system and other security measures in the facilities that can take or record photos of our guests and visitors in public places, as well as information related to your location during your stay in our facilities (through access cards and other technologies).
We process personal information in connection with hotel-related serviced, the transportation and the participation in all mini events during ISFR Ski Week Pamporovo 2025to provide you with services and for our business interests, including for marketing, service improvement, etc.
Event profiles: If you plan to visit any event with us, we collect event details, event date, number of guests, guest room details, and for corporate events - information about your organization. We also collect information about guests who are part of your group or event. If you visit us as part of a group, we may have personal information provided for you by the group and you may receive suggestions from us as a result of your stay in a group or an event visit, depending on your preferences and to the extent permitted by law. As you come as a participant in an event, we may share your personal data with the event organizers, to the extent permitted by law.
Social media: If you choose to participate in activities or offers on social networks organized by Rotary club Smolyan, we may receive certain information from your social network account according to your settings on the social network service, such as location, registrations, activities, interests, photos, status updates and list of friends. We may also give you the opportunity to participate in photo contests, such as those taken during your stay with us, which you can share with your contacts on the social networks for evaluation by voting, shared offers or other promotions. Participation in activities in social media, competitions and other promotional offers organized by Rotary club Smolyanis voluntary, i.e. based on your consent. We also use certain information for our business purposes, including for marketing, service improvement and analyses.
In addition to the information we collect directly from you, we may also infer information about you from the data you provide us or from Other information we receive. We may also collect information about you from third parties, including our airline partners, payment cards, etc., from your social networking services in accordance with your settings for these services and from other sources that are third parties and are legally entitled to share your information with us. We use and share this information (and may add this information to other information that we have about you) for the purposes described in this Privacy Notice.
Rotary club Smolyan processes your data for the above-stated purposes on one or more of the following grounds:
The processing is necessary to implement a contract with the Club, to which the data subject (participant) is a party, or to take steps to conclude a contract at the request of the data subject;
The processing is necessary to comply with a legal obligation that applies to the Club as a data controller;
The data subject (participant) has consented to the processing of his/her personal data for one or more specific purposes. The data subject (participant) has the right to withdraw his/her consent at any time.
The legitimate interest of Rotary club Smolyan or of a third party, when it takes precedence over the interests or fundamental right and freedoms of the data subject (participant), for example for the purpose of preventing crimes, including fraud, preventing money laundering and other lawful purposes.
Processing of personal data by consent of the data subject / Right of withdrawal of consent:
Rotary club Smolyan processes personal data of the data subject (participant) only with his/her consent in the following cases: (a) for the purposes of direct marketing; (b) when providing personal data to third parties; and (c) when processing sensitive data for the processing of which there is no regulatory obligation on the data controller.
In cases where we request consent for special (sensitive) personal data, we will always justify why and how this information will be used, except in cases where we process sensitive data in fulfilment of regulatory obligations.
In cases where the personal data of the data subject (participant) are processed solely on the basis of his/her consent, you can withdraw your consent at any time by submitting a request of withdrawal of consent.
You do not have the right to withdraw your consent, if Rotary club Smolyan processes your personal data on the grounds and for the purpose of entering into a contract with Rotary club Smolyan, fulfiling a regulatory obligation of Rotary club Smolyan as a data controller or protecting the legitimate interest of Rotary club Smolyan or a third party.
Personal information we share
To provide you with the expected level of hospitality, we may share your personal information with our service or event providers and other third parties, as described in detail below:
Bulgarian, international or foreign bodies, institutions and persons to whom Rotary club Smolyan is obliged to provide personal data under the applicable legislation (Court; Prosecutor’s Office; Investigation Service; Ministry of Interior; Ministry of Tourism; National Revenue Agency; National Social Security Institute; National Statistical Institute; State Agency for National Security, etc.);
Group events and meetings: If you visit facilities provided for byRotary club Smolyan as part of a group event or a meeting, the information collected for planning the meeting and the event will be shared with the organizers of such meetings and events and, where necessary, with the guests who organize or participate in the meeting or the event.
Business partners: We may partner with other companies to provide you with products, services or offers based on your experience in our facilities, and may accordingly share your information with our business partners such as tour operators or hotels, ski schools and wardrobes in cases where Rotary club Smolyan acts as an organizer.
On-site services: We may share personal information with third-party service providerswho provide on-site services such as restaurant services, recreational and sports services, etc.
Service providers: We rely on third parties to provide services and products on ourbehalf and may share your personal information with them, as appropriate. In principle, our service providers are contractually obliged to protect your personal information and are not allowed to use or share your personal information in any other way, except as may be required by law. However, our fraud detection service providers may use your personal information, without sharing it, to detect fraud. We may use service providers to communicate news or provide promotional materials and transaction materials to you on our behalf, including personalized online and mobile ads, depending on your preferences and the applicable laws. Rotary club Smolyan will only work with persons who offer a method to unsubscribe from such advertising. We may also share information with service providers that enable you to participate in all events and activities from lists that we have personalized for you based on your preferences and information from third parties.
Other : Furthermore, Rotary club Smolyan may disclose personal information in order to: (a) comply with the applicable laws, (b) respond to requests from the government or requests from the public authorities, (c) comply with existing legal procedures, (d) protect the rights, privacy, safety or property of Rotary club Smolyan, site visitors, guests, employees or the public, (e) allow us to seek available indemnification or restrictions of damages that may be caused to us, (f) apply the Privacy Notice and the General Terms of our websites, and (g) respond in emergency situations.
Rotary club Smolyan does not apply automated decision-making, including profiling.
Other information
When you visit and use the websites and applications of Rotary club Smolyan, we collect other data that does not directly disclose your identity for your use of the site, such as a directory of the sites you visit and the number of your visits to our sites (‘Other Information’). We use other information and data obtained from third parties to provide you with email, online (on our websites or other websites) and mobile ads.
We may use cookies and other technologies (such as ‘pixel tags’, ‘web beacons’, ‘clean GIFs’, email links, JavaScript, device IDs assigned by Google or Apple, or similar technologies) to obtain this information. If you want to remove or block Cookies at any time from your device, you can update your browser settings (see your browser’s help menu to learn how to delete or block Cookies). Rotary club Smolyan is not responsible for the settings of your browser. If you are located in Europe, you can also change your cookie preferences by making changes to the ‘Cookie Settings’ of the Cookie Consent Manager.
We do not currently respond to ‘Do Not Track’ alerts or similar mechanisms.
We may use the information collected or aggregated by us or anonymized personal information obtained from third parties to learn more about our users (for example, we may use aggregated information to determine the percentage of our users with a specific phone code). This includes demographics such as date of birth, gender and marital status, implied commercial interests, such as favourite products or activities, and other information that we may collect from your or from third parties.
Because the Other Information does not disclose your identity, we may disclose this information for any purposes, where permitted by law. In some cases, we may combine Other Information with Personal Information. If we combine Other Information with Personal Information, the combined information will be treated as Personal Data in accordance with this Statement.
Confidential information
The term ‘sensitive information’ refers to information, related to your racial or ethnical origin, political views, religious or philosophical beliefs, union membership, health status, sexual life or sexual orientation, genetic information, criminal history, and any biometric data used to for identification purposes.
Generally, we do not collect sensitive information, unless it has been voluntarily provided by you or if we are not required to do so by the applicable laws or regulations. We may use the health information provided by you to better serve and meet your specific needs (for example, to provide access for disabled people).
Personal information from children
We do not knowingly collect personal information from persons under the age of 18. As a parent or legal guardian, do not allow your children to submit personal information without your permission. For children under the age of 16, the use of our services is permitted only with the consent of a parent or guardian. In rare cases, as part of the booking, the ordering of services related to the travel or other emergencies (such as family amenities), Rotary club Smolyan may only collect and use information for children with the consent of a parent or guardian. If we process information about a child under the age of 16 without the clear consent of a parent or guardian, we reserve the right to delete this information.
Links to third-party websites and services
Our site may contain links to third-party websites. Please, note that we are not responsible for the collection, use, maintenance, sharing or disclosure of data and information from such third parties. If you provide information and use third-party websites, the Privacy Notices (Declarations) and General Terms of Service of these sites will apply. We recommend that you read the Privacy Notices (Declarations) on the websites you visit before submitting personal information.
Personal data protection
Rotary club Smolyan will take reasonable steps in order to: (a) protect the personal information against unauthorized access, disclosure, alteration or destruction, and (b) maintain the personal information accurate and up-to-date. The team of Rotary club Smolyan is responsible for monitoring our systems for potential intrusions, responding to a potential incident, maintaining information security and providing information security training of Rotary club Smolyan. IT professionals provide control over the systems that support certain accounting, registration, management and financial functions. In the event of a security incident, Rotary club Smolyan will notify the regulatory authorities and/ or users, as required by the applicable laws or regulations.
We also require our partners and service providers, with whom we share personal information, to make reasonable efforts to ensure the confidentiality of your personal information. For online transactions, we use technological means within the reasonable limits of protecting the personal information you send us through our website. However, unfortunately, there is no security system or data transfer system on the Internet that is fully secure.
For the protection of your privacy, please, do not send your payment card numbers or other confidential personal information by email.
Transfer of personal data abroad
Rotary club Smolyan does not intend to transfer your personal data to third parties in non-EU countries or international organizations (Rotary and ISFR not included) without first obtaining your consent, except when required by law by Competent Authorities.
Your rights as a data subject. Alteration and access.
At any time while we are storing or processing your personal data, you have the following rights:
You have the right to request a copy of your personal data, which is processed by Rotary club Smolyan, and the right to access your personal data at any time;
You have the right to request from Rotary club Smolyan to submit your personal data in a form convenient for transfer to another data controller and to request us to do it without being hindered by us;
You have the right to ask Rotary club Smolyan to correct without undue delay your inaccurate personal data, as well as data that are no longer up-to-date;
You have the right to request from Rotary club Smolyan your personal data to be deleted without undue delay, if any of the following reasons is available:
the personal data are no longer needed for the purposes for which they were collected;
when you have withdrawn your consent /in cases where the processing of your personal data is solely based on your consent/;
o when you have objected to the processing,
when the processing is unlawful;
where the personal data must be deleted in order to comply with a legal obligation under the EU or Member State law that applies to us as a data controller;
o where the personal data have been collected for the provision of information society services.
We may refuse to delete your personal data for the following reasons:
to comply with a legal obligation of Rotary club Smolyan;
for statistical purposes, to the extent that the deletion is likely to make impossible or seriously impede the achievement of the objectives of such processing, or for the establishment, exercise or defence of legal claims;
you have the right to request from Rotary club Smolyan to restrict the processing of your personal data, in which case the data will only be stored and not processed. Our refusal to restrict will explicitly be only in writing and we must motivate it for a legitimate reason;
you have the right to withdraw your consent to the processing of your personal data at any time by a separate request made to the data controller, in cases where the processing of your personal data is solely based on your consent;
you have the right to object to certain types of processing, such as direct marketing (unsolicited advertising messages);
you have the right to object to automated processing, including profiling;
you have the right not to be subject to a decision based solely on automated processing,
including profiling;
if we need to use your personal data for a new purpose that is not covered by this Privacy Notice, we will provide you with a new Privacy Notice and, when and where necessary, will require your prior consent for the new processing.
All above requests will be forwarded, if there is a third party (recipients, including non-EU and international organizations), when processing your personal data.
Right of appeal to the supervisory authority
You have the right to submit a complaint directly to the supervisory authority, as the competent authority in Bulgaria is the Personal Data Protection Commission, with address: No: 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia (www.cpdp.bg).
If you wish to submit a complaint regarding the processing of your personal data through Rotary club Smolyan (recipients, including non-EU and international organizations), you can submit it to the specified contact details of Rotary club Smolyan or directly to the Data Protection Officer (at the above-stated contact details.)
Storage of personal data
We will store your personal data for the period necessary to achieve the objectives set in this Privacy Notice, unless a longer storage period is required and/ or permitted by the applicable laws. We will retain the personal information collected to fulfilparticipants bookings for seven years after the end of the stay. We will retain other personal information for shorter periods, if possible and if permitted by the law.
We will destroy your personal data as soon as possible and in such a way that it cannot be reproduced or restored.
If printed on paper, the personal data will be destroyed securely by machine shredding (shredder) into small parts or otherwise, and if in electronic form, the personal data will be destroyed by technical means so that it cannot be reproduced or restored.
We will take all necessary technical and organizational measures to protect your data from unauthorized access. Who is responsible for processing personal data in Rotary club Smolyanand contacting us
If you have any questions about this Privacy Notice or about how Rotary club Smolyan processes your personal data or if you would like to send us a compliment or a complaint, you can contact us by email at:contacts@isfrpamporovo2025.comor by mail at address: Rotary club Smolyan, 4700 Smolyan, Kiparis Alfa Hotel, 3A Bulgaria boul. We will respond within 30 days or sooner, if applicable. If necessary, this period may be extended by another two months. The company shall inform the data subject of any such extension within 1 month of receipt of the request, indicating the reasons for the delay. Where the data subject submits a request by electronic means, the information shall, where possible, be provided by electronic means, unless otherwise requested by the data subject.
The Privacy Notice of Rotary club Smolyan is based on:
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, collectively referred to as the ‘General Data Protection Regulation’ (GDPR).
Questions and Answers: What are personal data?
According to the General Data Protection Regulation, personal data are defined as:
‘Any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or by one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person’. Can I find out what personal data you have and process?
Rotary club Smolyan will, at your request, answer you what information we store for you and how it is processed.
If we are processing your personal data, you can request the following information:
the purposes of processing;
the legal basis of processing;
the relevant categories of personal data being processed;
the recipients or categories of recipients to whom the data is or will be disclosed;
the recipients in third countries or international organizations, if there is a transfer of personal data to them, as well as guarantees that their data security will be at least at EU level;
if the processing is based on the legitimate interests of Rotary club Smolyan or a third party, information about these interests;
the period for which the personal data will be stored;
details of your rights to request correction or deletion of personal data or restriction of the processing of personal data, as well as to object to such processing;
information about your right to withdraw your consent at any time;
details of your right to appeal to a supervisory authority;
information on whether the submission of personal data is a mandatory or contractual requirement or a requirement necessary for the conclusion of a contract, and whether or not you are obliged to provide personal data and the possible consequences of the inability to provide such data;
the source from which your personal data is collected, when not collected directly from you;
all details and information about the availability of automated decision-making, such as profiling and any meaningful information about the underlying logic of these operations, as well as the significance and expected consequences of this processing.
How to receive access to my data that are processed?
You need to fill in a Data Subject Request Form or to submit a request to the specified contact details of Rotary club Smolyan or directly to the specified contact details of the Data Protection Officer.
