Privacy Policy
Privacy policy
‘Jordan Petkov’ foundation, UIC 206985610
19th November 2025
General provisions
1.1 The hereby privacy policy (the “Policy”) applies to all private persons that engage in relations with the ‘Buna’ foundation (the “Administrator”) or use any of its online platforms and serves to satisfy the requirements laid out in the Personal data protection act (the “PDPA”) and the General data protection regulation (Regulation No. 2016/679, the “GDPR”). The Policy applies to all personal data that is collected, processed and stored by the Administrator, including personal data collected through exlibris-competition-varna.org (the “Webpage”); other online resources and platforms; at the usual place of business of the Administrator and in other places where the Administrator might conduct business or cultural events.
1.2 Unless explicitly specified otherwise, this Policy does not apply to any personal data collected by third parties, regardless of whether these parties are in relations with the Administrator. The Policy does apply to personal data collected by third parties if they are acting as duly empowered representatives of the Administrator.
1.3 This Policy does not apply to personal data collected by webpages that mention or direct to exlibris-competition-varna.org.
2.1 The Policy adheres to and applies the PDPA and GDPR. The terminology and all concepts in this Policy are to be understood as they are defined in the LDP and GDPR and in the meaning and context of the same.
2.2 This Policy sets the terms of the use of ‘cookies’ in the Website insofar as they collect information that by itself or in conjunction with other information may be deemed to be personal data. For the purposes of this Policy, cookies are to be understood as small files that contain a series of values and are sent to the users’ browsers when visiting the Webpage. Cookies allow the server to recognise the user when it revisits the Webpage. Cookies may contain user preferences and other information.
Security systems
3.1 The Administrator shall undertake all legally prescribed actions aimed at protecting the private data it collects. The Administrator shall bear the responsibility for protecting the data from any and all illegal, such as unauthorised alteration and access, theft, etc.
3.2 The Administrator shall achieve the above goals by regularly updating its digital security systems and performing other necessary technical maintenance of its online resources and data banks.
3.3 The Administrator shall conduct regular training sessions for its employees where they will be acquainted with the latest rules and regulations and the proper application of this Policy.
When and why is data collected and processed
4.1 The Administrator may collect personal data when you:
a) use any component of the Webpage and have allowed the collection of cookies;
b) submit forms and requests to the Administrator, user cookie preferences notwithstanding;
c) send communications containing personal data to the Administrator’s electronic addresses;
d) call the Administrator over the phone and disclose personal data that is necessary for providing further services requested by you;
e) agree to be included in a mailing list.
4.2 The collection and processing of personal data pursuant to art. 4.1, pts. b), c) and d) is required for artists, organizers and volunteers in order for the same to participate in events organised by the Administrator. Collecting your personal data may be necessary for the entry into or performance of a contract between you and the Administrator.
4.3 The collection of data under art. 4.1, pt. a) is not mandatory and may be denied by the subject. Collecting and processing this data serves to enable the Administrator to provide personalised content through the Webpage and to gauge the interests of visiting users.
4.4 Not providing personal data in the cases listed under art. 4.1, pts. b), c) and d) will lead to a partial or total inability for the subject of the personal data to participate in events organised by the Administrator and / or to the inability to enter into and perform under contracts between the subject and the Administrator.
4.5 Collection of data under art. 4.1, pt. e) is required in order for you to receive the requested notifications regarding the Administrator’s activities. In these cases not providing your personal data will lead to the inability to send notifications to you.
What kind of data do we collect and process
5. Depending on the relationship between you and the Administrator, the Administrator may collect, process and store the following kinds of personal data:
a) names;
b) telephone number;
c) email address;
d) precise physical address, including geographic coordinates, which may match the usual place of residence of the subject;
e) in case the collection of cookies has been allowed by the subject and the information gathered by them is deemed to be personal data - any and all data regarding the way you interact with the Webpage, including, but not limited to a list of the goods and services you’ve viewed on it;
f) personal history, interests, professional experience, information about the personal life of the subject and other information that may or may not reveal the identity of the subject or may represent accounts of its personal life.
How long do we store your personal data and what are your rights in regards to it
6.1 The Administrator stores collected personal data for as long as is required in order to achieve the goal pursuant to which the data has been collected, which is usually the successful completion of the cultural events organised by the Administrator. This period may be determined by the length of the event; the lapsing of the copyright and other limited rights transferred from the subject to the Administrator; the due reporting of the Administrator’s activities to the competent authorities or the specifics of the event in which the subject has participated.
6.2 When the above goals are achieved the Administrator shall destroy the collected data unless its further processing and storing is allowed or required by law.
6.3 The Administrator shall return or destroy your personal data when such a request has been made by you, unless the returning or destruction of your data is limited or forbidden under the applicable regulations. Such a request may be made at any time. When personal data is returned or destroyed, further interaction between the subject and the Administrator may not be possible.
6.4 You may at any time:
a) request that the Administrator provides further clarification regarding the kinds of personal data that it has collected, processed and stored;
b) request clarification regarding the goals pursuant to which the Administrator has collected, processed and stored your personal data;
c) object to any specific way of processing of your personal data;
d) request to complete incomplete personal data or to correct incorrect personal data;
e) request information regarding the source of the personal data in case that the data has not been collected directly from you.
7.1 Requests under art. 6.4 of this Policy shall not incur costs for the requestor and shall be considered by the Administrator for no longer than one month. If the request is complex and / or there are multiple requests, the period may be extended to two months.
7.2 Requests made in bad faith, such as multiple repeating requests submitted in a short timeframe, may be disregarded by the Administrator. The Administrator may deny fulfilling a request for the reasons listed under art. 37a of the PDPA.
7.3 All requests shall be made in a way that allows for the Administrator to identify the requestor, i. e. to verify that the requestor is either itself the subject of the personal data or is the representative of the latter. If the identity of the requestor cannot be established with certainty the Administrator may request additional evidence to that end. If the additional evidence provided by the requestor does not serve to establish its identity with certainty, the Administrator shall disregard the request and notify the requestor.
Disclosure of personal data to third parties
8.1 The Administrator may disclose your personal data to authorities in the cases provided for under the PDPA and GDPR and other laws and regulations.
8.2 If the specifics of an event organised by the Administrator require it, the Administrator may disclose your personal data to third parties. These are the cases where, for example, the Administrator may disclose the artists’, organizers’ and volunteers’ personal data to third parties who are acting as contractors for the Administrator and the disclosure is necessary for the due performance of their duties. Said performance may include, but is not limited to running advertisement campaigns, lodging participants in the event, transporting the participants and / or their materials, transporting the artworks of the participants, etc.
8.3 Disclosures under the above article shall be limited to what is necessary for the due performance of the Administrator’s and third party’s duties. The disclosure may include personal data that may by itself or in combination with data reveal the identity of the subject or ways to contact it directly by phone and / or mail, or the usual residence of the subject.
8.4 In some occasions the Administrator may need to make public a limited set of personal data. Such disclosures may occur, for example, when the Administrator needs to run advertisement campaigns or otherwise popularise an event in which the subject is a participant. In these cases the personal data may include the true identity of the persons participating in the event, details regarding their artworks, their life as artists and other details. The Administrator is barred from revealing personal data that has no relevance to the art of the participant or its life as an artist or data that has no relation to the public persona of the participant.
8.5 Disclosures under art. 8.2-8.4 shall be made without seeking further consent from the subject.
8.6 The Administrator is barred from disclosing your personal data, subject to the provisions in this Policy. Unless required to do so by law or treaty, the Administrator does not disclose your personal data to international organisations or to state bodies representing countries outside the European Union.
Collection and processing of personal data received from third parties
9.1 The Administrator freely enters into relations with various third parties. In some cases a third party may disclose personal data to the Administrator.
9.2 Personal data disclosed under the above article may include such data that may, by itself or in combination with other data, reveal the identity of the subject, its email or telephone contact information and / or its usual residence.
9.3 When the Administrator collects personal data under art. 9.1, both the Administrator and the subject of the personal data shall be granted all rights and undertake all obligations listed under this Policy, the PDPA and GDPR. Personal data collected under art. 9.1 shall be used exclusively for the goals, pursuant to which it was disclosed to the Administrator and shall be stored for a period that is no longer that what is necessary for achieving those goals.
Contact information and final provisions
10.1 The Administrator’s contact information is as follows:
Physical address: Bulgaria, Varna, 8 ‘Han Krum’ str., ground floor
Email: office@largogallery.com
10.2 This Policy shall enter into force from the day it is published on the Webpage. The Administrator may amend or terminate the Policy at any time. The amendment or termination of the Policy shall enter into force from the moment the termination notice or amended policy has been published. All amendments to the Policy shall apply both for data collected before and after the amendment has entered into force.
10.3 If at any point the subject of the personal data deems that its rights have been infringed, it has the right to bring a complaint before the competent state body or court.
10.4 Any and all disputes regarding the collection, processing and storing of personal data and the application and / or infringement of this Policy shall be brought before the relevant courts located in the province of Varna, Bulgaria. This rule shall not apply in cases where the usual residence of the subject of the personal data is located outside Bulgaria.