Privacy Policy

At "ULEN" AD we understand the responsibility we bear for your personal data and strive to observe high standards for the protection of personal information and privacy. We collect, store and process your personal data only to the extent that this is necessary to carry out our activities, with clearly defined objectives and compliance with the requirements of REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of April 27, 2016 on the protection of natural persons in connection with the processing of personal data and on the free movement of such data (in short, the Regulation) and the Personal Data Protection Act (PDPA).

This privacy policy applies to the website, social networks and commercial outlets of "ULEN" AD, a company operating in the field of tourism and providing tourist services on the territory of Bansko Ski Center, and aims to inform you in a responsible manner, in that we process your personal data in our activities and to acquaint you with your rights arising from the Regulation and the legal basis regulating personal data.

The policy was developed by "ULEN" AD, EIK 101156430, with address Bansko 2770, Pirin St. No. 94 - in its capacity as the Administrator of personal data.

According to Regulation (EU) 2016/679, personal data is any information with which a natural person can be identified. Personal data should be considered a name, identification number, location, online identifier or one or more characteristics specific to the physical, physiological, genetic, mental, mental, economic, cultural or social identity of a particular natural person. In this policy, personal data means any information about you, such as your names, date of birth, your personal identification number; postal address, identity document number (identity card, passport), photo, e-mail address, telephone number, information about your participation in Bansko Loyalty Club which is providing various privileges, information about your participation in games organized by us and other data of yours that you have provided to us when using the services offered by us and through which you can be uniquely identified.

How do we receive your personal data?

Ulen AD, in its capacity as an Administrator, collects and processes personal data at every contact with customers in the process of providing various types of services in its activity. We strive to ensure lawful, fair and transparent processing of personal data, for specific, legitimate purposes expressly indicated in this policy, respecting the principles of "data minimization", "accuracy", "storage limitation", "integrity and privacy" and "accountability".
The processing of personal data is carried out in the presence of one/several of the following reasons:

1. Processing is necessary for the performance of a contract to which the data subject is a party or to take steps at the request of the data subject prior to the conclusion of a contract.

2. The processing is necessary for compliance with a legal obligation that applies to "Ulen" AD, in its capacity as a personal data administrator.

3. The data subject has consented to the processing of his personal data for one or more specific purposes. In cases where personal data is processed solely on the basis of consent, the data subject has the right to withdraw consent at any time, with the exception of cases where data processing is also based on reasons 1 and/or 2, mentioned above.

4. the processing is necessary to protect the vital interests of the data subject or another natural person;

5. the processing is necessary for the performance of a task of public interest or in the exercise of official powers granted to "Ulen" AD, in its capacity as a personal data administrator;

6. The processing is necessary for the purposes of the legitimate interests of the Administrator.

We strive to establish and maintain responsible business relationships, to provide quality and timely services tailored to your preferences and needs, and in this regard we may ask you for additional information in order to improve the quality of services. We process part of the collected personal data to maintain accountability for the services and products we provide you, by analyzing the services used so that we can manage them effectively and plan our development. "Ulen" AD offers targeted discounts for certain age categories, when using them it is necessary to reflect your date of birth or the number of a document certifying the conditions entitling the person to purchase the relevant category of service, in order to comply with the requirements of accounting and tax legislation, such as when paying and using the service, we need to check your identity documents or the appropriate other document certifying the conditions.

The information you provide may be used to send you useful information about special offers, promotions and new products and services, some of which may be presented in conjunction with other organizations. In such case your personal data will only be used upon receipt of your consent.

In an effort to create a safe and secure environment for tourists at Bansko Ski Center, we may use some of the collected personal data, including the installed video surveillance system, to detect and prevent fraud, theft and other unwanted activities. In some cases, we may need to use your information for the processing and resolution of legal disputes, for the application of the rules for the use of the service "ski equipment rental", "ski/snowboard school", "use of lift facilities at Bansko Ski Center, through a purchased lift pass/ticket”, etc., to comply with the rules and General Terms and Conditions established in Bansko Ski Center (you can read them HERE), to fulfill lawful requests from law enforcement bodies or authorities.

Some of the services we offer also include services under our affiliate programs provided by third parties. If you participate in such a package or service, your personal information will be shared with that third party only and only after receiving your express consent and to the extent and scope necessary to provide that service and to process the request.

The categories of personal data we process and the purposes for which it is processed

We process your personal data in the process of providing rental equipment in the ski wardrobes managed by us. The types of personal data collected when renting equipment are: names, date of birth; address; place of accommodation; e-mail (with consent by the client); weight; height, age; skiing skills, gender; shoe size, sole length, and the purposes of processing are: a step to conclude a rental contract and provide the "ski/snowboard equipment rental" service; to fulfill the rights and obligations arising from the concluded rental agreement; protection of the health and life of customers, by providing appropriate safe equipment, consistent with the provided by the physical person’s data; payment of a certain category of service determined by the person's age and/or height; a legal obligation arising from tax legislation; receiving information and/or offers, with the express consent of the person, provision of quality service and legitimate interest. You can get acquainted with the General rules and conditions for renting ski/snowboard equipment from the ski shops managed by "Ulen" AD HERE.

We process your personal data in the process of providing the services: individual ski/snowboard training; group ski/snowboard lessons; "Elite" ski/snowboard lessons, cross-country skiing, Junior Ski school and the service "First run" provided by Ulen Ski School. The types of personal data that are collected when using the services of Ulen Ski School are: names, date of birth; address/city, country, city code, street/, e-mail (with the consent of the client) and skiing skills, with the purposes of processing being: a step for concluding a contract for the use of a service and providing the services : individual ski/snowboard training; group ski/snowboard lessons; "Elite" ski/snowboard training, cross-country skiing, Junior Ski school and the "First run" service provided by Ulen Ski School; to fulfill the rights and obligations arising from the concluded service contract; protecting the health and life of clients by assigning them to an appropriate group and/or ski instructor; payment of a certain category of service determined by the person's age; a legal obligation arising from tax legislation; receiving information and/or offers, with the express consent of the person, provision of quality service and legitimate interest. You can read the General rules and conditions for using the services offered at the Ulen Ski School, managed by "Ulen" AD, Bansko HERE.
Your personal data also comes to us when you purchase and use lift tickets from Ulen's ticket offices, from our partners, online through the “Ski Point” App, through the Bansko Ski App and through the kiosk devices. The types of personal data processed in this process are: names; photo, date of birth or document number certifying the conditions entitling the person to purchase the relevant category of lift card; telephone or e-mail for contact; data about the payment made, the purposes of processing being: identification of the person; registration of the person in the "Ski point" App and in the Bansko Ski App; the possibility of feedback to him in the process of processing the request, including restoring access to the person's profile in the mobile platform or in the application, if she/he has forgotten the password; step when concluding a contract for the provision of a service - activation of a lift tickt/pass ensuring the usage of lift facilities at Bansko Ski Center; fulfillment of obligations under a contract for the provision of a service; prevention of unregulated use of the lift passes contrary to the approved General Rules; purchase of a certain category of card determined by the person's age; registration in Bansko Loyalty Club, providing privileges for its members, with the express consent of the person; notifying members of Bansko Loyalty Club about upcoming events and/or privileges included in the Program related to their rights arising from it; using services under our partner programs and receiving information and/or offers related to these partnerships, with the express consent of the person; legal obligations / powers arising from the Bulgarian legislation / tax, the Ordinance on safety and information security of the ski slopes, etc./; ensuring public order in the ski area; legitimate interest of the company; providing quality service and analysis. The user can receive commercial messages, news, offers and contacts if he has accepted his data to be used for direct marketing. Unsolicited information for marketing purposes may also be sent to the e-mail address specified by the User, and the User is clearly and unequivocally informed of the nature of the message.

Some of the personal data is necessary to introduce to you the terms of participation in Bansko Loyalty Club and the privileges it provides you. Participation in our Loyalty Program, which is aimed at those winter sports enthusiasts who purchase season passes, will give you the opportunity to receive personalization of the services provided, according to the type of pass you own. In order to join the program, you must meet the conditions set by the company and provide a limited amount of additional personal data that will allow us to provide you with certain services and participation in individual events. By enrolling in the Program, you confirm your desire to participate in it, you agree to the announced General Terms and Conditions, which also determine the possible use of your personal data, you give your consent for using the e-mail for the explicitly indicated purposes.

We also process your personal data when you make an inquiry and make a reservation for accommodation, both on site and through registration in tourist platforms (Booking, etc.). Personal data provided in this process, such as: names/in Cyrillic for Bulgarians and in Latin for foreigners; personal identification number; date of birth, gender; citizenship; ID number or valid national identity document; the state issued the identity document; address; contact information about the person, information related to the reservation itself and the payment of the stay are necessary for the purpose of: identifying the person; the possibility of feedback to her/him in the process of processing the reservation request; contractual relations in connection with the provision of tourist services (accommodation of customers; fulfillment of a legal obligation /under the Law on Tourism, Law on Foreigners in the Republic of Bulgria); providing a better quality service tailored to your preferences.

Personal data of customers is also processed when sending a request or registration for participation in games announced on our website http://www.banskoski.com. The categories of personal data that are processed are: two or three names/depending on the game/, e-mail, phone number; date of birth, social security number and valid postal address, ID card number, date of issue, issuing authority and validity necessary for the purpose of: registration of the person for participation in the game, feedback to restore access to the person's profile, if forgotten by her/him password; identification of the person, both for participation in the game and for winning and for subsequent receipt of the prize; feedback to the person upon winning a prize from the Campaign and tax treatment of the prize won, according to Bulgarian legislation. The processing of the specified personal data is necessary for participation in the games, and the participants in them give their express consent for the personal data provided by them to be processed for the specified purposes.

Your personal data is also processed when visiting our website, using the Bansko Ski App, the Ski Point App or when contacting us through profiles on social networks, such as Instagram, Facebook, etc. The personal data we have access to is names, photos, friend list, location, registrations, interests, etc. depending on your personal profile setting. Please note that the website may contain links to the website of third parties, bearing in mind that we are not responsible for the collection and processing of data by these parties. If you provide information to and use sites other than our official site, you should be aware that the Privacy Policies which those sites apply. “Ulen” AD is not responsible for the collection and processing of personal data by these third parties.
A limited volume of your personal data is also processed when registering in the "Bansko Ski" App. In addition to this policy, “Ulen” AD has a specialized Privacy Policy that describes the responsible way in which we process your personal data when using this application.
You can read this policy HERE. We recommend doing this before using the Bansko Ski App.

When processing your personal data, we observe the following principles:

1. Your personal data will be processed only for the purposes stated above. A change in processing purposes can only occur with your express consent.

2. Your personal data is protected with appropriate technical and organizational security measures, also when we interact with third parties.

3. We endeavor to keep your personal data up-to-date for the purposes set out above.

4. Your personal data is processed only as long as it is necessary to achieve the above-mentioned purposes, after which it will be deleted in a reliable way, unless there are legal requirements or legitimate interests to keep it for certain periods.

5. We will respect your rights to the protection of your personal data and will satisfy any of your requests in this regard within the statutory period.

6. When it is necessary to share your data with third parties in order to provide you with the services and products you have requested, we will require compliance with the rules laid down in this Policy and in the personal data management organization developed and implemented in “Ulen” AD.

7. We comply with the restrictions on the processing of personal data of persons under 16 years of age, obtained in the conditions of the information society, as well as sensitive personal data.

8. We will make every effort to promptly inform you if we receive your personal data from third party partners, suppliers or other business sources.

9. Your personal data is processed in compliance with the applicable legal and regulatory requirements, in the conditions of transparency and professional correctness. We do not collect or process sensitive personal data, such as race, religious beliefs, political orientation or trade union affiliation.

10. We will endeavor to respond to any queries you may have regarding the processing of your personal data within 14 days. If gathering the necessary data to prepare a response requires the commitment of a substantial resource on our part, we will promptly inform you and provide you with a written response no later than 30 days after receiving the inquiry.

Who do we share your data with?

Your personal data may be shared with third parties who are the operator of your personal data, participating in the process of providing the services you use, such as: issuing lift tickets/passes in certain objects that are explicitly listed in the General Terms and Conditions for issue, sale, validity and use of lift cards, production of plastic cards for Bansko Loyalty Club members, implementation of security activities on the territory of the ski center, organization of games or other activities of subcontractors. In such cases, your personal data will be processed under controlled conditions, only to the extent strictly necessary to provide the service. The third parties/operators involved in the provision of these services are fully aware of the requirements of REGULATION (EU) 2016/679 for the protection of personal data and have undertaken to comply with the terms of our Privacy Policy. “Ulen” AD maintains permanent contractual relations with these companies. If necessary, the requirements for the lawful processing of personal data can be formed in agreements between “Ulen” AD, as Administrator of personal data, and the supplier companies, as Processors of personal data.

Your personal data may be shared with our partner companies to inform you in the form of commercial messages about other services provided by them. Such messages will only be sent with the User's prior consent, which the User may revoke at any time. In individual cases, unsolicited commercial messages may be sent to the e-mail address provided by the User, subject to compliance with the statutory procedure.

In all other cases, we will only process, disclose or share your personal data if required by law or where required to comply with the requirements of public authorities acting under statutory authority.

Where do we store and how do we process your personal data?

Your personal data is stored electronically on our servers, which are located in a controlled environment with a high level of information security. We take the possible organizational and technical measures to protect data, applying established good practices and the requirements of information security standards.

“Ulen” AD has developed and implemented a documented system for managing and protecting personal data. The implementation of this system is dictated by our desire to strictly adhere to the requirements of REGULATION (EU) 2016/679 and of the GDPR). It introduces rules for the processing of data, both of our customers and of our employees and representatives of the organizations with which we partner to achieve the purposes that require the processing of personal data. The guidelines of established good practices and the requirements of international information security standards are laid down in the personal data protection system. Our employees are trained to comply with the requirements of the implemented system. Access to your personal data is based on the "need to know" principle in accordance with the functional duties of our staff and those of our partner organizations. Where necessary, we have signed agreements defining the responsibilities and obligations of “Ulen” AD and that part of our partners/contractors who can gain access to the personal data of our customers and employees.

Your rights:

Your rights as a data subject are listed in Art. 12-23 of Regulation 2016/679 and include the right to receive information and access; to correct and delete personal data (right to be forgotten); to restrict processing; for data portability at your request to another administrator, as well as the right to object to data processing. You also have the right to receive confirmation as to whether your personal data is being processed; information about the purposes of the processing; information on the categories of personal data processed; information on the processing period; information about with whom it is shared, as well as to receive a copy of your personal data being processed.

If you have consented to the processing of your personal data and decide for some reason to withdraw it, we will delete the processed data, unless there is a legal requirement or a legitimate interest in its storage for a certain period.

If you have any questions about our Privacy Policy or in relation to your rights regarding the processed personal data, you can contact the Data Protection Officer at “Ulen” AD at email: dpo.banskoski@gmail.com or write to us at address: reg. Balgoevgrad, commune. Bansko, City of Bansko 2770, Pirin St. No. 94.

If you are not satisfied with the answer received, or if you consider that there is a violation of your data protection rights in connection with the processing of your personal data by “Ulen” AD, you can submit a complaint to the Commission for the Protection of Personal Data at the following contacts: Sofia 1592 , Prof. Tsvetan Lazarov Blvd. 2, https://www.cpdp.bg and/or another supervisory/regulatory body.

This Policy is subject to updating as necessary. The current version will be available to you immediately after the introduction of a change, and we therefore invite you to review it periodically.