Privacy Policy

Who processes your data

The controller of personal data within the meaning of Regulation (EU) 2016/679 (GDPR) and the Personal Data Protection Act is:

FINBIZZ EOOD, UIC 208714643, VAT No. BG208714643, with registered seat and address of management: 15 Tsarigradsko Shose Blvd., entrance V, Sredets district, 1124 Sofia, Bulgaria.

The platform at finbizz.eu and the FINBIZZ Balkans event are organised by FINBIZZ EOOD. For data protection questions, please write to [email protected].

What data we collect

We collect only what we need, and only where we have a legal basis for it. By source:

Registration of interest

First name, last name, business e-mail, job title, company, country and the topics you have indicated as being of interest to you. Together with these we record the IP address, browser data, the page from which you submitted the form and the advertising parameters in the address, if you arrived through a campaign.

Partnership enquiry

First and last name, e-mail, company, telephone and the content of your message, plus the same technical data as above.

Ticket purchase

Names, e-mail, telephone and company of the purchaser; for each ticket purchased, the first name, last name and e-mail and, optionally, the job title and company of the participant, as well as the day selected in the case of one-day tickets. We also record the IP address from which the order was placed.

Invoice

Only where you expressly request an invoice: company name, UIC or other identification number, VAT number, address, city and country.

Payment

Payment is made through Stripe. Your card details are entered in a field loaded directly from Stripe and do not pass through our servers. We receive and store only a reference to the payment, the amount, the currency and its status.

Correspondence

The e-mail address and the content of the confirmations and notifications sent to you, so that we can evidence what was sent and when.

Participation in the event

Data from the check of the ticket or badge at the entrance (ticket number, time of entry).

Photographs and video recordings

Your image and voice in photographic and video material from the event, including in the recordings of the sessions.

Newsletter and marketing communications

E-mail address, name and subscription history (date and manner in which consent was given, unsubscription).

Technical records

IP address, browser data, page address, time and status of the request. We use them for security, diagnostics and protection against abuse, including for limiting the number of requests to the forms and to payments.

Traffic analytics

Only with your consent: pages visited, time spent, source of the visit, device and browser type, approximate location based on IP address, as well as recordings of your interaction with the page (cursor movement, scrolling, clicks) in order to improve the interface. The content of the fields in the forms is not recorded.

Advertising measurement

Only with your consent: the pages visited and the actions performed on the platform, in order to measure the results of the advertising campaigns and to build advertising audiences.

Administrator accounts

Only for the team managing the content: name, e-mail, password (stored solely as an irreversible hash), IP address and browser of the active sessions, as well as a record of the administrative actions performed.

We do not require special categories of personal data (health, biometrics, political or religious beliefs and the like). We do not take decisions in respect of you based solely on automated processing, including profiling.

Where you purchase a ticket for another person, you provide us with that person’s personal data. By placing the order you confirm that you are entitled to do so and that you have informed the person concerned of this policy.

Why and on what legal basis

We process your data on one of the following legal bases under Article 6(1) GDPR:

• Performance of a contract (Article 6(1)(b)) for the sale of a ticket, its issuance, access to the event and the correspondence relating to the order, as well as in order to take steps at your request prior to entering into a contract, for example in the case of a partnership enquiry.
• Legal obligation (Article 6(1)(c)) for the accounting and tax reporting of payments and of the invoices issued.
• Consent (Article 6(1)(a)) for registrations of interest and partnership enquiries, for receiving marketing communications, for traffic analytics and advertising measurement, for the loading of content from external providers and for the provision of your data to partners for subsequent contact. Consent may be withdrawn at any time.
• Legitimate interest (Article 6(1)(f)) for the security of the platform, protection against abuse and spam, technical support and the defence of legal claims, for the processing of the data of the Participants designated by the Purchaser for the purpose of issuing the tickets and providing their access to the event, as well as for filming the event in general footage and using the materials for its coverage and promotion.

The provision of data is voluntary, but without the data marked as mandatory we are unable to process your order or to respond to your enquiry.

With whom we share them

We provide data to the following categories of recipients. Where the recipient is a processor, it acts on our instructions and on the basis of an agreement under Article 28 GDPR. Where it is a separate or joint controller, this is expressly stated:

Payment operator

Stripe Payments Europe, Ltd. (Ireland) processes card payments. It receives your payment data, e-mail and the amount. Stripe acts as a separate controller for the purposes of fraud prevention and compliance with financial legislation.

E-mail service provider

Brevo sends the transactional messages: order confirmations, tickets and notifications. It processes the e-mail address and the content of the message.

Hosting and technical support

The platform and the database run on infrastructure in the European Union, maintained by our technical contractor, which has access to the data only to the extent necessary for maintenance and operation.

Traffic delivery and protection

Cloudflare, Inc. (USA) carries the traffic to the platform, encrypts the connection (HTTPS) and protects it from attacks and automated requests. It processes the IP address and the technical data of every request.

Web analytics

Google Ireland Limited processes the data from Google Analytics 4: pages visited, traffic source, device type and browser identifier. It is loaded only with your consent.

Behaviour analytics

Microsoft Ireland Operations Limited processes the data from Microsoft Clarity: session recordings, heatmaps and statistics on the use of the interface. It is loaded only with your consent.

Advertising measurement

Meta Platforms Ireland Limited receives the data from the Meta Pixel: pages visited and actions performed, in order to measure the results of the advertising campaigns and to build advertising audiences. For the collection and transmission of these data, FINBIZZ EOOD and Meta are joint controllers under Article 26 GDPR. The subsequent processing by Meta is under its own responsibility, in accordance with its privacy policy. It is loaded only with your consent.

Accounting services

The data in the invoices and payment documents are processed by the external accounting firm which services us, for reporting purposes.

Partners and exhibitors

They receive data only in the cases under item 02 “Contacts with partners” – through your own action or with your consent. Partners process the data received as separate controllers, in accordance with their own privacy policies.

Venue and event suppliers

The venue operator, the providers of registration and access control, catering, the photographers and videographers – to the extent necessary for the organisation and security of the event.

We do not sell your data and do not provide them to third parties for their own marketing purposes without your consent. We may disclose data to the competent authorities where we are legally obliged to do so (a court decision, a request by the prosecution service or by an investigating authority).

Transfers outside the EU

The platform and the database are located in the European Union. Traffic to the platform passes through the network of Cloudflare, Inc. (USA). The providers of web analytics, behaviour analytics and advertising measurement under item 04 are European companies within the Stripe, Google, Microsoft and Meta groups and may transfer data to their parent companies in the USA. Where such a transfer takes place, it is based on:

• The EU-US Data Privacy Framework and Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the adequate level of protection – for the companies certified under it.
• Standard contractual clauses under Commission Implementing Decision (EU) 2021/914 for the remaining cases, accompanied by a transfer impact assessment.

Cookies and tracking

The platform uses as few cookies as possible. The necessary ones are always active. All the others (external content, analytics and advertising) are switched off by default and are activated only with your consent. Detailed information about each cookie, its provider, purpose and lifetime is set out in the Cookie Policy.

You may change or withdraw your consent at any time through “Cookie settings” at the bottom of each page. Withdrawal stops the loading of the relevant tools going forward and does not affect the lawfulness of the processing carried out before it.

How long we keep the data

Registrations of interest

24 months from the last communication with you

Partnership enquiries

24 months from the last communication with you

Orders, payments and invoices

10 years under the Accountancy Act, counted from the beginning of the following reporting year

Participant data per ticket

Up to 12 months after the edition for which the ticket was purchased has been held

Photographs and video recordings from the event

For as long as they are used for the coverage, archive and promotion of FINBIZZ, unless you object

Marketing consent

Until you withdraw it; the evidence of the consent given is kept for up to 3 years after the withdrawal

Records of messages sent

Up to 24 months

Technical and security records

Up to 12 months

Traffic analytics data

Up to 14 months, in accordance with the settings of the respective provider

Advertising measurement data

Up to 13 months

Administrative sessions and audit log

Sessions up to 14 days; the audit log up to 24 months

Once the periods indicated have expired, the data are deleted or anonymised, unless longer storage is necessary for the defence of a legal claim or is required by law.

Your rights

Under the GDPR you have the following rights in respect of your personal data:

• Access (Article 15) to the data we store about you and a copy of them.
• Rectification (Article 16) of inaccurate or incomplete data.
• Erasure (Article 17), known as the right “to be forgotten”, in the cases provided for by law.
• Restriction of processing (Article 18) in the cases provided for by law.
• Portability (Article 20) of the data you have provided to us, in a structured, machine-readable format, where the processing is based on consent or on a contract.
• Objection (Article 21) to processing based on legitimate interest, as well as at any time to processing for direct marketing purposes.
• Withdrawal of consent (Article 7(3)) at any time, without this affecting the lawfulness of the processing carried out before the withdrawal.
• Complaint to the supervisory authority: Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, cpdp.bg, [email protected], tel. +359 2 915 3 518.

To exercise any of these rights, please write to [email protected]. We respond within one month in accordance with Article 12(3) GDPR. In the case of complex or numerous requests, the period may be extended by a further two months, of which we will inform you. If we have reasonable doubts as to your identity, we may request additional information in order to confirm it.

Security

We apply technical and organisational measures appropriate to the risks to the rights and freedoms of data subjects:

• Encryption of all traffic via HTTPS/TLS.
• Passwords stored solely as an irreversible hash.
• Server sessions with a limited lifetime and the ability to terminate them immediately.
• Segregated administrative roles and access to data only for those who need it.
• An audit log of administrative actions.
• Rate limiting of requests to the forms and to payments as protection against abuse.
• Regular backups of the database.
• Payment data do not pass through our servers.

In the event of a personal data breach we notify the Commission for Personal Data Protection in accordance with Article 33 GDPR and, where the breach results in a high risk to your rights, we also notify you in accordance with Article 34 GDPR.

Children

The platform and the event are intended for professionals and are not directed at persons under 16 years of age. We do not knowingly collect children’s data. If we establish that we have received such data without the consent of a parent or guardian, we will delete them.

Changes to this policy

We may update the policy. The current version is always published on this page, with the date of the last revision stated at the beginning. In the case of material changes we will notify you by e-mail, if we have your address, or through a message on the platform.

Contact

Questions, requests concerning your rights or feedback:

[email protected] · +359 898 454505

See also the Terms and Conditions, which govern participation and the purchase of a ticket, and the Cookie Policy.