We at In the Palace want you to understand what information we collect, and how we use and share it. That is why we encourage you to read our Privacy Policy. This helps you use in the way that is right for you. In the Privacy Policy, we explain how we collect, use, share, retain and transfer information. We also let you know your rights. Each section of the Policy includes helpful examples and simpler language to make our practices easier to understand. We have also added links to resources where you can learn more about the privacy topics that interest you.
This Privacy Policy is intended to help you understand what kind of Personal Data we collect, why we collect it and how we use it.  Please take the time to read this Privacy Policy carefully as we want you to be aware of how we use your information and the ways in which you can protect your privacy. We are committed to maintain robust privacy protections for our users.
This Privacy Policy applies to your Personal Data when you visit www.inthepalace.com (the Website) or use our services through this Website and does not apply to the online Website or services that we do not own or control. 
When you use our services available on the Website, you accept that you have read and understood this Privacy Notice in connection with the processing of personal data. You can contact our Data protection contact person at any time via our contact form.
We respect the right to privacy and work continuously to keep the data we process to a minimum and as secure as possible. However, in order for you to use our services, we need to process some personal data.
 
WHO ARE WE?
The company that provides services to you in its capacity as a personal data administrator is In The Palace International Short Film Festival Foundation, with UIC 206422277, with headquarters and management address: Sofia, 1504, Oborishte district, 11 "Gerlovo" street; email: tagamlitzka@inthepalace.com;
Responsible for personal data protection is: Galina Tagamlitzka.
 
DESCRIPTION OF THE PERSONAL DATA PROCESSED BY US
The personal data that is collected from our Website is divided into the following categories:
Personal data of users;
Personal data of visitors and of data obtained from a contact form;
 
PERSONAL DATA OF USERS
Categories of data subjects
-       Users - Users of the Website are person who create a profile in our Website, and use the data, provided by us.
Categories of personal data
When a person uses the services provided by our Website, as a User, we will process the following personal data about that person:
a)    When registering as a User - names, email address, country of origin;
b)    To receive an invoice for a service used - names, social security number (or date of birth) and address;
We do not store or collect your bank account data! 
 
Purposes and legal grounds for processing
We will process the personal data of the Users for the purposes of Identification of the person as a User. The legal basis for the processing is the fulfilment of pre-contractual and contractual obligations, in connection with the use of the service offered by the Website and consent from the data subject.
We have lawful bases to collect, use and share data about you. You have choices about our use of your data. At any time, you can withdraw consent you have provided by going to settings. We will only collect and process personal data about you where we have lawful bases. Lawful bases include consent (where you have given consent), contract (where processing is necessary for the performance of a contract with you. Where we rely on your consent to process personal data, you have the right to withdraw or decline your consent at any time and where we rely on legitimate interests, you have the right to object.
Storage period
We keep information as long as we need it to provide our Products, comply with legal obligations or protect our or other’s interests. We will store the personal data received through our Website during your registration as a User on our Website and until the deactivation of your customer profile.
Recipients of personal data
We may share Users personal data with the following third parties: Company employees; computer and software service providers; providers of tax and accounting services and auditors; legal consultants and lawyers; State bodies of executive and judicial power;
 
PERSONAL DATA OF VISITORS AND OF DATA OBTAINED FROM A CONTACT FORM ("CONTACT US")
When we have received an inquiry from an individual through our contact form available on the Website, we will use the contact details provided by them (names and email address) to contact them and provide them with the information or assistance they require.
Personal data obtained through the contact form will be stored for a period of up to 6 (six) months from receiving of the relevant inquiry.
 
METHOD OF COLLECTION
Each visitor provides personally the personal data, entered or uploaded to the Website. 
Visitors are not allowed to enter third party personal data without due authorisation by such third party. We do not monitor or control the content, entered or uploaded by the visitor. It is the visitor’s sole responsibility to provide and guarantee that the processing of personal data activities performed within our Website are compliant with the requirements of the GDPR and other applicable personal data protection legislation.
 
SECURITY MEASURES
We take appropriate technical and organisational measures to protect your personal data against loss or other forms of unlawful processing. We make sure that personal data is only accessible by only those who need access to do their job, and that they are properly trained and authorised. Our staff is required to conduct themselves in a manner consistent with the company’s guidelines regarding confidentiality, ethics, and appropriate usage of data. Staff is required to execute a confidentiality agreement and are provided with proper training in online privacy and security.
 
WHY WE COLLECT PERSONAL INFORMATION 
We shall use your personal data to in order for you to make a registration in our Website and use the services that we provide; to inform you, via email, about any developments on our projects, to present to you our services and to request your opinion on topics related to our products and services, incl. via questionnaires, research forms, etc.
We collect your personal data, based on your explicit consent to provide it for the purposes, listed above. By accepting this privacy policy, you provide your explicit consent to us to use your personal data for the purposes listed above. 
 
INFORMATION WE SHARE
We do not share personal information with companies, organisations and individuals unless one of the following circumstances applies:
With your consent - we will share personal information with companies or organisations, when we have your explicit consent to do so; 
For making some services possible – to third party processors, as described above;
For legal reasons - we will share personal information with companies, organisations or individuals, if we have a good-faith belief that access, use, preservation or disclosure of the information is reasonably necessary to: meet any applicable law, regulation, legal process or enforceable governmental request; investigation of potential violations; detect, prevent, or otherwise address fraud, security or technical issues; protect against harm to the rights, property or safety of ours, our visitors or the public as required or permitted by law.
We don't sell any of your information to anyone, and we never will. We also require and other to follow rules about how they can and cannot use and disclose the information we provide.
 
MINORS
We allow our Website to be used only by persons aged 18 and over. If aged under 18, please ask for the assistance of a person aged at least 18 in order to use our Website.
If we obtain actual knowledge that we have collected personal data from a person under the age of 18, we will promptly delete it, unless we are legally obligated to retain such data. 
Please, contact us, if you believe that we have mistakenly or unintentionally collected information from a person under the age of 18.
 
YOUR RIGHTS
You have the right to request a copy of your personal data at any time, to check the accuracy of the stored information, to correct or update this information, to ask for your personal information to be deleted if there are grounds for doing so, as described below. You also have the right to complain when your privacy rights have been violated. Below is a detailed description of your rights as a personal data subject:
-      You have the right to request confirmation if personal data relating to you is being processed and to request a copy of your personal data as well as the information relating to the collection, processing and storage of your personal data.
-      You have the right to request your personal data to be deleted if there are any of the following grounds: personal data is no longer necessary for the purposes for which they have been collected; where you have objected against the processing when the processing is unlawful; where data is processed on your consent and you withdraw that consent; where personal data must be deleted in order to comply with a legal obligation under Union law or the law of a Member State applicable to the controller. You may be denied deletion of your personal data for the following reasons: exercising of the right of freedom of expression and the right to information; to comply with our legal obligation or to carry out a task of public interest or in the exercise of the official authority that has been granted to us; for reasons of public interest in the field of public health; for the establishment, exercising or protection of legal claims.
-      You have the right to request your personal data to be corrected if it is inaccurate or to be supplemented if it is incomplete.
-      You have the right to request the restriction of the processing of your personal data if applicable and there is a reason to do so, for example: you dispute the accuracy of personal data for a period that allows us to verify the accuracy of personal data; the processing is illegal, but you do not want personal data to be deleted but only to be limited; we do not need any more personal data for the purposes of processing, but you require them to identify, exercise or protect your legal claims; you have objected against the treatment pending verification that our legitimate grounds have an advantage over your interests.
-      You have the right to request to receive personal data which concerns you and which you have provided in a structured, widely used and machine readable format, and you have the right to transfer this data to another administrator when the processing is based on consent or on contractual obligation and the processing is done in an automated manner.
-      You have the right to make an objection against the processing of your personal data before the Data Protection contact person if there are reasons to do so.
You can address all requests to the Data Protection contact person. In order to be able to provide you with full assistance, please provide us with accurate information about you and specify your request. It is possible that, in the exercise of your rights, we may ask for additional information to establish your identity.
Please keep in mind that when your requests are clearly unreasonable or excessive, in particular because of their repeatability, we can:
charge a fee, taking into account the administrative costs of providing information or communication or undertaking the requested activities, or
Refuse to take actions on the request.
We will make reasonable efforts to respect your request within 30 days of receiving your application. If necessary, this term may be extended by a further two months, taking into account the complexity and the number of requests.
We may reject requests that are unreasonably repetitive, require disproportionate technical effort (for example, developing a new system or fundamentally changing an existing practice), risk the privacy of others, or would be extremely impractical (for instance, requests concerning information residing on backup systems). Where we can provide information access and correction, we will do so for free, except where it would require a disproportionate effort.
If you file a privacy-related complaint, we will collect your name and/or company name, name of a complaint-related person, email, and country location and details that gave rise to your complaint. We will use the information you provide to investigate your complaint and to send you an answer once your complaint is reviewed.
 
SUPERVISORY AUTHORITY
If you think we have infringed your privacy rights, you can lodge a complaint with the supervisory authority in the particular in the country where you live, your place of work or place where you believe we infringed your right(s).
 
CHANGES TO OUR PRIVACY POLICY
We reserve the right to change this policy at any time. We will notify you of significant changes to our Privacy policy by sending a notice on your email address or by placing a prominent notice on our Website. Significant changes will go into effect 30 days following such notification. Non-material changes or clarification will take effect immediately. You should periodically check this Privacy policy for updates.