Privacy Notice

Privacy Policy

INTRODUCTION

This is the privacy policy of Seafox Ltd, trading under the company name ‘iBoris’. Seafox Ltd has its registered offices located in Bulgaria, 113 Gen. Kolev St , 9002 Varna, office building "Nikulitsel", fl. 3, office 3.4 and is registered under company number 202246127. In this privacy policy, Seafox Ltd will be referred to as "iBoris", "us" or "we".

iBoris attaches the utmost importance to the protection of your personal data. This privacy policy describes how we protect your personal data and who you can contact for more information or to exercise your legal rights.

This privacy policy applies to the Processing of Personal Data of:

(potential) customers of iBoris and their contacts;
(potential) suppliers of iBoris and their contacts;
visitors to the website of iBoris.

If you provide us with personal data of other persons, e.g. your employees, you should inform these persons about our privacy policy before you entrust us with their personal data. For our part, we will make every effort to inform you and these persons and to ensure that personal data is safe with us.

We reserve the right to change our privacy policy from time to time if legislation or our internal procedures make it necessary. You can consult the current version of our privacy policy at any time on our website iboris.eu/policies/privacy-policy.

CONTENT OF OUR PRIVACY POLICY

Overview

The controller
The purposes for processing personal data
The legal grounds for processing personal data
The personal data processed and, where appropriate, the need for their disclosure
Duration of processing and data retention
Categories of recipients and transfer of personal data
Your rights regarding the processing of your personal data
Contacting iBoris in relation to data processing

1. The controller

The legal entity controlling the processing of your personal data is Seafox Ltd, as described in the introduction. Seafox Ltd. (hereafter iBoris) is the controller of the processing of your personal data as it has determined the purposes and means of processing.

2. The Purposes for processing personal data

IBoris processes personal data of (contacts of) its customers and suppliers and of visitors to its website for the following purposes:

Processing of personal data of customers, potential customers and their respective contacts for the purpose of sending offers, invoicing, after-sales service, management of the customer or sales relationship, as well as for legally required purposes linked to this purpose;
Processing of personal data of customers, customer contacts and potential customers for direct marketing;
Processing of personal data of suppliers, potential suppliers and their respective contacts for the purposes of procurement, after-sales service, management of the supplier relationship, as well as for legally required purposes linked to this purpose;
Processing personal data of visitors to our website who complete the contact page, for the sole purpose of responding to the request sent in by the visitor.

3. The legal grounds for processing personal data

The legal ground for these processing activities is respectively:

For the processing of personal data of (contacts of) customers and potential customers for the purpose of sales:
- If you are a natural person customer and we process your personal data for the performance of the contract:
  - the need to perform our contract with you.
- If you are an employee (or representative) of our customer or potential customer and the customer or potential customer has provided us with your contact details:
  - the need for iBoris and the customer to be able to use the following legitimate interests: to organise the conclusion or execution of the contract and to communicate with each other about it. Given the limited use made of your contact details, we believe that these interests outweigh your interests or fundamental rights and freedoms. If you disagree, please refer to section 7 below on your legal privacy rights.
For the processing of personal data of (contacts of) suppliers and potential suppliers for the purpose of procurement, after-sales service, management of the supplier relationship our legal ground is:
- If you are a natural person supplier:
  - the need to perform a contract with you.
- If you are an employee (or representative) of the supplier and the supplier or potential supplier has provided us with your contact details:
  - the need for iBoris and the supplier to be able to use the following legitimate interests: to organise and communicate with each other on the establishment or execution of the contract. Given the limited use made of your contact details, we believe that these interests outweigh your interests or fundamental rights and freedoms. If you disagree, please refer to section 7 below on your legal privacy rights.
For the processing of personal data for legal reasons (such as after-sales warranty) or for tax or accounting purposes:
- compliance with European or national legislation.
For the processing of personal data of visitors to our website who complete the contact page or quote request, for the sole purpose of responding to the visitor's request:
- the need to take actions at the request of the data subject prior to the conclusion of a contract;
- the need for iBoris to pursue following legitimate interests: deal with your request and act on it. Since you have taken the initiative to submit your request via the contact page (and we assume that you want a response) and the limited use made of your data to respond to you, we believe that the interests of iBoris outweigh your interests or fundamental rights and freedoms. If you disagree, please refer to section 7 below on your legal privacy rights.

4. The personal data processed and, where appropriate, the need for their disclosure

For customers
- Name of natural person customer or company*
- Legal form*
- Address*
- VAT number
- Company registration number
- For a corporate customer: contacts*
- Function or capacity
- Email address*
- (Mobile) Phone number*
- Bank account number and banking institution
These personal data are processed for the purpose of sales and legally required purposes linked to that purpose.
Personal data marked with * above must be provided.
For suppliers
- Name of natural person supplier or company supplier
- Legal form
- Address
- VAT number
- Company registration number
- For a corporate supplier: contacts
- Contract information
- Email address
- (Mobile) Phone number
- Bank account number and banking institution
Suppliers are required to provide all the above information. Data is processed for the purpose of purchase and legally required purposes linked to that purpose.
- For visitors to the website (in general)
- IP address
- For visitors to the website who fill in the contact page
- Name
- Email address
- (mobile) phone number
- message filled in on the contact page
- Answer to your question
- IP-address
This data is provided on a purely voluntary basis. However, if you send a request, you must enter your name, email address and a message. The personal data will only be processed to give appropriate follow-up to your request.

5. Duration of processing and data retention

For customers: We process your personal data for the purpose of sales for as long as you have the status of an active customer. Personal data of inactive customers will be retained for as long as necessary for legal, compliance, tax or accounting reasons, or for as long as your purchases may give rise to claims.
For suppliers: We process your personal data for as long as it is necessary in the context of the contracts we have concluded with you. After the termination of our active cooperation with you, your personal data will be retained for as long as necessary for legal, compliance, tax or accounting reasons.
For website visitors who complete the contact page: We process your personal data for as long as it is necessary to process and act on your request. Thereafter, the data will not be retained (except where appropriate in the context of processing for other purposes as set out in this privacy policy).

6. Categories of recipients and transfer of personal data

iBoris transfers your Personal Data to the following categories of recipients:
- Processors used for the purpose of a specific task (e.g. IT service providers and accountant). These processors may only use the data for the purposes determined by iBoris and in accordance with this Privacy Policy. iBoris currently uses the following (sub)contractor(s):
  - IT service provider
  - Bookkeeper
  - legal unit where the contracts are stored
  - Dropbox
  - Microsoft (outlook/onedrive)
  - Cloud server provider
  - Subcontractors under a contract
Without prejudice to the above, iBoris may need to disclose your personal data:
- To the competent authorities (i) when we are obliged to do so by law, an express request from these services or in the context of judicial or future legal proceedings and (ii) to safeguard and defend our rights.
- When we transfer substantially all of our assets to a third party, in which case your personal data will be one of the transferred assets.
If this communication of personal data involves a transfer outside the European Union, to a country without an adequate level of data protection, iBoris will ensure that appropriate contractual provisions are in place to protect your privacy.

7. Your rights regarding the processing of your personal data

As a data subject you have a number of rights you can exercise with regard to iBoris. If you wish to exercise any of these rights please contact us using the contact details set out below.

The rights you have are the following:

Right of inspection: you have the right to inspect the personal data we collect from you and to inspect how we process your personal data. You also have the right to obtain a copy of your personal data.
Right to rectification: you have the right to update or rectify inaccurate personal data we process.
Right to data erasure: in certain circumstances, you can request that we erase your personal data.
Right to restrict processing: you have the right to request that we stop using your personal data in specified circumstances such as if you believe that the personal data we collect about you is inaccurate or that our use of your personal data is unlawful. If you validly exercise this right, we will store your personal data and will no longer process it.
Right to object: where we rely on our legitimate interests to process your personal data, you have the right to object to this interest.
Right to portability: you may ask us to obtain certain personal data that you have provided to us in a structured, common and machine-readable form, and you have the right to ask us to transfer your personal data directly to another controller where this is technically possible.

Even after adjusting, correcting or deleting your Personal Data, copies of it may remain visible elsewhere to the extent the Personal Data has been shared with others, or distributed pursuant to your privacy settings, or copied. iBoris will take reasonable steps to notify third parties to whom your Personal Data has been transferred of your request to delete any reproduction of your Personal Data. Deleted Personal Data will in no event remain on iBoris's backup for more than ninety (90) days.

In principle, you can exercise these rights free of charge. To do so, please send a request with a copy of your identity card to our e-mail address. This is to prevent any unauthorised disclosure of your personal data.
- If your request is manifestly unfounded or excessive, we may charge a reasonable fee for the administrative costs associated with your request or we may refuse your request.
- In any case, we will always inform you of the action taken on your request within a period of one month at the latest.

8. Contact in connection with data processing

If you wish to exercise any right provided under point 7, or if you have any questions, comments or complaints in relation to our privacy policy or the way we process your data, please contact us at our privacy e-mail address: privacy@iboris.eu.
If you still have complaints, you may lodge a complaint with the Supervisory Authority: www.cpdp.bg/en/.