Personal data protection policy of Entase, Inc.

in the implementation of its activity - electronic sales (online) of tickets for cultural events through the Entase web platform

This policy aims to inform users of the Entase web platform for the collection of their personal data via this website or directly received by phone or email.

Certain measures have been implemented by Entase, Inc. in order to ensure that only personal data is processed by default that is necessary for each specific purpose of the processing in terms of the volume of personal data collected, the degree of processing, the period of their storage and their accessibility, and the measures ensure that, by default, without intervention on the part of the individual, personal data is not accessible to an unlimited number of individuals.

Entase, Inc. with its headquarters in Oregon, USA. Address for correspondence: 9450 SW Gemini Dr PMB 47339, Beaverton, OR 97008, USA.

Entase, Inc. conducts electronic sales of tickets for cultural events (theatrical productions, cultural, entertainment and other events), carrying out this activity through a web-based platform: www.entase.bg.

In these cases, it collects and processes your personal data in connection with the provision of its services, namely: the conclusion and execution of contracts for the online sale of tickets for cultural events (theatrical productions, cultural, entertainment and other events), such as Entase, Inc.. concludes the contracts on behalf and at the expense of the organizer of the cultural event.

When concluding and executing contracts for the sale of tickets, Entase, Inc.. and the organizer of the event act as joint administrators of personal data with regard to the personal data collected and processed by them of users purchasing tickets.

- First and last name;
- Phone number;
- Email address;
- Payment data and for the bank card - the type of card (Visa, MasterCard, etc.) and the last 4 (four) digits of its number, when the preferred payment option is payment by card / bank payment;
- Social status (retired/student/disabled) – when a special ticket purchased at a preferential price is issued.

Data is collected, recorded, organized, processed and stored in electronic (digital) form in the information system of the web platform: www.entase.bg.

- for the purpose and on the basis of the conclusion and execution of contracts for the sale of an ordered ticket for a cultural event, i.e. personal data are necessary for the conclusion and execution of the contract for the sale of tickets.
The legal basis for data processing is Art. 6, par. 1, letter "b" of the General Data Protection Regulation (EU) 2016/679 and art. 4, paragraph 1, item 3 of the GDPR.
The provision of personal data by the subject is a necessary requirement for the conclusion and execution of the contract, without which it is impossible for the contract to be concluded and executed.
- in order to fulfill the legal obligations of Entase, Inc.. for accounting and tax reporting and declaration of tax obligations according to Bulgarian legislation (Law on accounting, the Corporate Income Tax Act, the Value Added Tax Act and other applicable regulations).

The legal basis for data processing is Art. 6, par.1, letter "c" of the General Data Protection Regulation (EU) 2016/679 and art.4, paragraph 1, item 1 of the GDPR.
The provision of personal data by the subject is a necessary requirement for the fulfillment of the legal obligations of the administrators for accounting and tax reporting and declaration of tax obligations, without which it is impossible to fulfill them.

- for the purpose of sending an electronic newsletter and informational messages to customers - users of the web-based platform: www.entase.bg regarding offered by Entase, Inc. and cultural and other events organized by the organizers.

The personal data collected and processed for this purpose are: e-mail, telephone number and names of the natural persons who buy a ticket through the platform.

Personal data for this purpose are collected and processed only on the basis of the prior express consent of the user, before or after the conclusion of a contract for the purchase - sale of a ticket for a cultural and other event, as giving consent to participate in this program does not is a condition for the purchase of the ticket and the conclusion of the contract.

Withdrawal of consent to the processing of personal data can be done in one of the following ways: a hyperlink in a received advertising (informational) e-mail message or a notification in a free text by email to Entase, Inc.

When withdrawing consent to processing Entase, Inc. is obliged to stop the processing of the user's personal data for these purposes.

The legal basis for the processing of the data for the purpose of sending an electronic newsletter and informational messages is Art. 6, par.1, letter "a" of the General Data Protection Regulation (EU) 2016/679.

In the execution of contracts for the online sale of tickets and the contract between Entase, Inc.. and the organizers of the event and for the fulfillment of tax and accounting legal obligations, the categories of recipients are:

- the joint administrators - organizers of the cultural events for which tickets were purchased
- payment service providers - for the payment of the ticket;
- accountant;
- National Revenue Agency;

- IT company serving the information systems of the administrators.

When processing for the purpose of sending an electronic newsletter and informational messages, the categories of recipients are - IT company serving the information systems of the administrator, and the joint administrators - organizers of events for which tickets have been purchased.

Entase, Inc. has the right and can transfer the collected and processed personal data to a public authority or to a payment service provider or an IT company in a third country that is not a member of the European Union, or to an international organization, in cases where this is necessary for the implementation of the concluded purchase contract - sale of a ticket for a cultural or other event or is necessary for the fulfillment of legal obligations of the administrator, regardless of the presence or absence of a decision of the European Commission regarding the adequate level of protection in the relevant third country or international organization, the presence of appropriate guarantees or subject's consent.

The legal basis for the transfer of personal data in these cases is Art. 49, Par. 1, letters "b" and "c" of Regulation (EU) 2016/679.

The terms for storing and deleting the users' personal data are determined depending on the purpose and basis for which they were collected.

A) The personal data that are processed for the purpose and on the basis of the conclusion and execution of the contracts for the purchase and sale of a ticket for a cultural event: until the completion of the execution of the contractual relations for the specific event.

B) The personal data that are processed in order to fulfill the legal obligations of Entase, Inc.. for accounting and tax reporting and declaration of tax obligations according to Bulgarian legislation (Accounting Act, Corporate Income Tax Act, Value Added Tax Act and other applicable legal acts) are stored in the following terms:

- the primary accounting documents, including those for tax control according to the Tax Insurance Procedural Code (DOPK), are kept for a period of 5 years after the expiration of the limitation period for repayment of the public obligation, which is reported and certified with the relevant document;
- personal data in accounting registers and financial reports, if such are contained in them, are stored - 10 years according to the Accounting Law.
- personal data in all other media - 5 years according to the Accounting Law.

C) Personal data processed for the purpose of sending an electronic newsletter and information messages to users of the web-based platform: www.entase.bg are stored until the user's consent is withdrawn. Personal data are deleted and deleted upon withdrawal of consent to processing, unless there is a reason for their storage on another basis.

Every natural person whose personal data is processed by Entase, Inc. has the following rights:

- right of access to the personal data related to the person, which are processed by the company/organization;
- right to correct or supplement inaccurate or incomplete personal data;
- right to erasure ("right to be forgotten") of personal data that are processed illegally or with a lost legal basis (expired storage period, withdrawn consent, completed initial purpose for which they were collected, etc.);
- right to limit processing - in the presence of legal dispute between Entase, Inc.. and the individual until its resolution and/or for the establishment, exercise or defense of legal claims;
- right to data portability - if processed in an automated manner on the basis of consent or contract. For this purpose, the data is transmitted in a structured, widely used and machine-readable format. If it is technically feasible, the data can be transferred directly from Entase, Inc.. to another administrator. The right to portability only covers data provided personally by the data subject, as well as personal data generated and collected by his activity.
- right to object - at any time and on grounds related to the individual's specific situation, provided that there are no compelling legal grounds for the processing that take precedence over the interests, rights and freedoms of the data subject, or a judicial process;
- right not to be subject to a fully automated decision involving profiling that gives rise to legal consequences for the data subject or affects him to a significant extent. Entase, Inc.. does not use in its activities technologies that anticipate and allow the making of fully automated decisions, including profiling.
- the right to be notified in the event of a breach of the security of his personal data, in case, that the violation created a high risk for his rights and freedoms.

The subjects of personal data exercise their rights by submitting a request to Entase, Inc.. The request can be submitted by mail or e-mail:

The data subject may submit a request for the exercise of his rights to any of the other joint controllers – event organizers or Entase, Inc.

Entase, Inc.. shall consider the request and respond to the data subject by providing him with information on the actions taken by the company in connection with his request to exercise his rights, or if it has not taken action on the request of the data subject data, to inform him of the reasons for the refusal and of the possibility of filing a complaint with the Commission on the ZLD and seeking legal protection.

Entase, Inc.. examines the request and responds to the subject without undue delay, but in all cases within a period of no longer than one month from receipt of the request. If necessary, this period can be extended by another two months, taking into account the complexity and number of requests. Entase, Inc.. informs the data subject of any such extension within one month of receiving the request, indicating the reasons for the delay.

When the data subject submits a request by electronic means, the information shall be provided by electronic means whenever possible, unless the data subject has requested otherwise.

If the data subject has requested it, the information may be given verbally, provided that the identity of the data subject is proven by other means.

Consideration of subject requests, action taken and responses to subjects are provided free of charge. When the requests of a data subject are manifestly unfounded or excessive, in particular due to their repetition, Entase, Inc.. may either:

a) charge a reasonable fee, taking into account the administrative costs of providing the information or communication or taking the requested action, or
b) refuse to take action on the request. Entase, Inc.. bears the burden of proving the manifestly unfounded or excessive nature of the request.

When there are reasonable concerns regarding the identity of the natural person submitting a request, Entase, Inc.. may request the provision of additional information necessary to confirm the identity of the data subject.

Data subjects have the right to submit a complaint to the Commission for the Protection of Personal Data, the right to a judicial appeal against a decision or refusal or delay in considering his appeal by the Commission, as well as the right to bring an action before a court in cases where their rights are violated.