[{"data":1,"prerenderedAt":580},["ShallowReactive",2],{"en-static-privacy":3},{"id":4,"title":5,"body":6,"description":572,"extension":573,"meta":574,"navigation":575,"path":576,"seo":577,"stem":578,"__hash__":579},"en_static\u002Fen\u002Fstatic\u002Fprivacy.md","Privacy policy",{"type":7,"value":8,"toc":549},"minimark",[9,20,23,36,41,61,109,116,120,123,141,144,148,153,164,168,184,188,205,209,223,230,234,317,321,324,354,361,365,372,376,411,415,418,462,472,476,479,501,505,512,516,519,523,530,534,537],[10,11,13],"h1",{"id":12},"privacy-policy",[14,15,5],"span",{"className":16},[17,18,19],"text-center","w-full","block",[21,22],"hr",{},[24,25,26],"p",{},[27,28,29,30],"em",{},"Last updated: ",[31,32,33],"mark",{},[14,34,35],{},"dd.mm.yyyy",[37,38,40],"h2",{"id":39},"_1-who-we-are","1. Who we are",[24,42,43,44,48,49,52,53,56,57,60],{},"This policy explains how ",[45,46,47],"strong",{},"GenCloud Ltd."," processes personal data in connection with the ",[45,50,51],{},"cardlink.bg"," website, the ",[45,54,55],{},"app.cardlink.bg"," platform and the ",[45,58,59],{},"CardLink"," service.",[62,63,64,71,82,88,99],"ul",{},[65,66,67,70],"li",{},[45,68,69],{},"Data controller:"," GenCloud Ltd.",[65,72,73,76,77],{},[45,74,75],{},"Company ID (UIC):"," ",[31,78,79],{},[14,80,81],{},"fill in company ID",[65,83,84,87],{},[45,85,86],{},"Address:"," Sofia 1510, Bulgaria, 47 Rezbarska Str., fl. 4",[65,89,90,76,93],{},[45,91,92],{},"Email for data-related questions:",[94,95,98],"a",{"href":96,"title":97},"mailto:card@cardlink.bg","Email for contacting Cardlink","card@cardlink.bg",[65,100,101,76,104],{},[45,102,103],{},"Data Protection Officer:",[31,105,106],{},[14,107,108],{},"fill in name and email, if appointed",[24,110,111,112,115],{},"We process personal data in accordance with ",[45,113,114],{},"Regulation (EU) 2016\u002F679 (GDPR)"," and the Bulgarian Personal Data Protection Act.",[37,117,119],{"id":118},"_2-in-what-capacity-we-process-data","2. In what capacity we process data",[24,121,122],{},"CardLink acts in two different capacities, and the difference matters:",[62,124,125,131],{},[65,126,127,130],{},[45,128,129],{},"As a controller"," – for the data of Site visitors and of our Clients (the companies using the Platform). We determine the purposes and means of processing.",[65,132,133,136,137,140],{},[45,134,135],{},"As a processor"," – for the data of ",[31,138,139],{},"cardholders",", which our Clients enter or collect through the Platform. In that case the respective Client is the controller and we act on its documented instructions under a data processing agreement (DPA).",[24,142,143],{},"If you are a cardholder with a question about your data, please contact first the company that issued your card.",[37,145,147],{"id":146},"_3-what-data-we-process","3. What data we process",[149,150,152],"h3",{"id":151},"site-visitors","❂ Site visitors",[62,154,155,158,161],{},[65,156,157],{},"technical data: IP address, browser and device type, language, operating system;",[65,159,160],{},"visit data: pages viewed, date and time, referrer;",[65,162,163],{},"preferences stored in cookies – language and light\u002Fdark theme.",[149,165,167],{"id":166},"feedback-form","❂ Feedback form",[62,169,170],{},[65,171,172,175,176,179,180,183],{},[45,173,174],{},"email address",", ",[45,177,178],{},"phone number"," and the content of the ",[45,181,182],{},"message"," you send us.",[149,185,187],{"id":186},"platform-clients","❂ Platform Clients",[62,189,190,193,196,199,202],{},[65,191,192],{},"company data: name, company ID, address, billing details;",[65,194,195],{},"contact person data: name, email, phone, position;",[65,197,198],{},"account data: username, hashed password, roles and permissions;",[65,200,201],{},"access and activity logs from the Platform;",[65,203,204],{},"payment data and issued documents.",[149,206,208],{"id":207},"cardholders-processed-on-behalf-of-the-client","❂ Cardholders (processed on behalf of the Client)",[62,210,211,214,217,220],{},[65,212,213],{},"identification data: name, cardholder code;",[65,215,216],{},"contact data: email, phone;",[65,218,219],{},"at the Client's discretion – date of birth, gender, city and other fields configured in the card project;",[65,221,222],{},"card data: type, status, validity, accumulated bonus points, transaction and activation history.",[24,224,225,226,229],{},"We ",[45,227,228],{},"do not collect"," bank card data. Payments are handled by licensed payment service providers.",[37,231,233],{"id":232},"_4-purposes-and-legal-bases","4. Purposes and legal bases",[235,236,237,250],"table",{},[238,239,240],"thead",{},[241,242,243,247],"tr",{},[244,245,246],"th",{},"Purpose",[244,248,249],{},"Basis under Art. 6 GDPR",[251,252,253,262,270,278,286,294,302,309],"tbody",{},[241,254,255,259],{},[256,257,258],"td",{},"Providing the Service and performing a contract",[256,260,261],{},"Art. 6(1)(b) – performance of a contract",[241,263,264,267],{},[256,265,266],{},"Account registration and support",[256,268,269],{},"Art. 6(1)(b)",[241,271,272,275],{},[256,273,274],{},"Replying to enquiries via the feedback form",[256,276,277],{},"Art. 6(1)(b) and (f) – legitimate interest",[241,279,280,283],{},[256,281,282],{},"Issuing and updating cards in Apple\u002FGoogle Wallet",[256,284,285],{},"Art. 6(1)(b) \u002F Client instructions",[241,287,288,291],{},[256,289,290],{},"Accounting and tax obligations",[256,292,293],{},"Art. 6(1)(c) – legal obligation",[241,295,296,299],{},[256,297,298],{},"Security, abuse prevention, logging",[256,300,301],{},"Art. 6(1)(f) – legitimate interest",[241,303,304,307],{},[256,305,306],{},"Functional cookies for language and theme",[256,308,301],{},[241,310,311,314],{},[256,312,313],{},"Marketing messages to Clients",[256,315,316],{},"Art. 6(1)(a) – consent",[37,318,320],{"id":319},"_5-recipients-of-the-data","5. Recipients of the data",[24,322,323],{},"Data may be shared with:",[62,325,326,336,342,345,348,351],{},[65,327,328,331,332,335],{},[45,329,330],{},"Apple Inc."," and ",[45,333,334],{},"Google LLC"," – to the extent necessary to issue and update the card in the respective wallet;",[65,337,338,341],{},[45,339,340],{},"Cloudflare, Inc."," – hosting and protection of the Site and the Platform;",[65,343,344],{},"email and SMS providers – for sending messages to cardholders;",[65,346,347],{},"payment service providers – when the payment subsystem is used;",[65,349,350],{},"accounting, legal and audit advisers;",[65,352,353],{},"public authorities – only where required by law.",[24,355,356,357,360],{},"All our providers are bound by agreements ensuring a level of protection consistent with the GDPR. We ",[45,358,359],{},"do not sell personal data",".",[37,362,364],{"id":363},"_6-transfers-outside-the-eu","6. Transfers outside the EU",[24,366,367,368,371],{},"Some of our providers (Apple, Google, Cloudflare) also process data outside the European Economic Area. Such transfers take place on the basis of the European Commission's ",[45,369,370],{},"standard contractual clauses"," or an adequacy decision.",[37,373,375],{"id":374},"_7-retention-periods","7. Retention periods",[62,377,378,385,392,399,405],{},[65,379,380,381,384],{},"feedback form data – up to ",[45,382,383],{},"12 months"," after the communication ends;",[65,386,387,388,391],{},"Client account data – for the term of the contract and ",[45,389,390],{},"up to 12 months"," after its termination;",[65,393,394,395,398],{},"accounting documents – ",[45,396,397],{},"10 years"," under the Bulgarian Accountancy Act;",[65,400,401,402,404],{},"access and security logs – up to ",[45,403,383],{},";",[65,406,407,408,360],{},"cardholder data – as instructed by the Client acting as controller; upon termination of the contract it is returned or deleted within ",[45,409,410],{},"60 days",[37,412,414],{"id":413},"_8-your-rights","8. Your rights",[24,416,417],{},"As a data subject you have the right to:",[62,419,420,426,432,438,444,450,456],{},[65,421,422,425],{},[45,423,424],{},"access"," the data processed about you and receive a copy of it;",[65,427,428,431],{},[45,429,430],{},"rectification"," of inaccurate or incomplete data;",[65,433,434,437],{},[45,435,436],{},"erasure"," (the \"right to be forgotten\");",[65,439,440,443],{},[45,441,442],{},"restriction"," of processing;",[65,445,446,449],{},[45,447,448],{},"data portability"," in a structured, machine-readable format;",[65,451,452,455],{},[45,453,454],{},"object"," to processing based on legitimate interest;",[65,457,458,461],{},[45,459,460],{},"withdraw consent"," at any time, without affecting the lawfulness of processing carried out until then.",[24,463,464,465,467,468,471],{},"Exercise your rights at ",[94,466,98],{"href":96,"title":97},". We respond within ",[45,469,470],{},"one month",", which may be extended by a further two months in complex cases — we will notify you if so.",[37,473,475],{"id":474},"_9-complaints","9. Complaints",[24,477,478],{},"If you believe your rights have been infringed, you may lodge a complaint with:",[24,480,481,484,487,488,490,496,497],{},[45,482,483],{},"Commission for Personal Data Protection",[485,486],"br",{},"\nSofia 1592, 2 Prof. Tsvetan Lazarov Blvd., Bulgaria",[485,489],{},[94,491,495],{"href":492,"title":483,"rel":493},"https:\u002F\u002Fwww.cpdp.bg",[494],"nofollow","cpdp.bg"," · ",[94,498,500],{"href":499},"mailto:kzld@cpdp.bg","kzld@cpdp.bg",[37,502,504],{"id":503},"_10-security","10. Security",[24,506,507,508,511],{},"We apply technical and organisational measures, including encryption of the connection (",[45,509,510],{},"TLS","), password hashing, role-based access to data, action logging, regular backups and access control over our infrastructure. Nevertheless, no method of transmission over the internet is completely secure.",[37,513,515],{"id":514},"_11-automated-decision-making","11. Automated decision-making",[24,517,518],{},"We do not carry out automated decision-making producing legal effects for you, including profiling within the meaning of Art. 22 GDPR.",[37,520,522],{"id":521},"_12-children","12. Children",[24,524,525,526,529],{},"The Service is not directed at persons under ",[45,527,528],{},"16 years of age",". If we learn that we have received a child's data without the consent of the holder of parental responsibility, we will delete it.",[37,531,533],{"id":532},"_13-changes-to-this-policy","13. Changes to this policy",[24,535,536],{},"This policy may be updated. We publish the current version at this address with a new last-updated date, and we notify our Clients by email of material changes.",[24,538,539,540,544,545,360],{},"See also the ",[94,541,543],{"href":542},"\u002Fen\u002Fcookies","Cookies policy"," and the ",[94,546,548],{"href":547},"\u002Fen\u002Frights","Terms of use",{"title":550,"searchDepth":551,"depth":551,"links":552},"",2,[553,554,555,562,563,564,565,566,567,568,569,570,571],{"id":39,"depth":551,"text":40},{"id":118,"depth":551,"text":119},{"id":146,"depth":551,"text":147,"children":556},[557,559,560,561],{"id":151,"depth":558,"text":152},3,{"id":166,"depth":558,"text":167},{"id":186,"depth":558,"text":187},{"id":207,"depth":558,"text":208},{"id":232,"depth":551,"text":233},{"id":319,"depth":551,"text":320},{"id":363,"depth":551,"text":364},{"id":374,"depth":551,"text":375},{"id":413,"depth":551,"text":414},{"id":474,"depth":551,"text":475},{"id":503,"depth":551,"text":504},{"id":514,"depth":551,"text":515},{"id":521,"depth":551,"text":522},{"id":532,"depth":551,"text":533},"How CardLink and GenCloud Ltd. process personal data under the GDPR – what we collect, on what basis, for how long and what rights you have.","md",{},true,"\u002Fen\u002Fstatic\u002Fprivacy",{"title":5,"description":572},"en\u002Fstatic\u002Fprivacy","4DtHpNK_gEavQ7QA4X-7pstsS3sGUVL1xr6sXazvFT8",1790579833437]