The protection of the personal data of individuals and the use of cookies by “UNIVERSAL EXPRESS 2” Ltd. is fully compliant with Regulation (EU)2016/679 (the “Regulation”). The use of the websites of “UNIVERSAL EXPRESS 2” Ltd. – www.saunaclubbg.com is possible without providing personal data. If a user wants to use special services through our website (inquiry, links to social networks, watching videos), the processing of personal data may be necessary. If the processing of personal data is necessary and there is no legal basis for such processing, we ask for the user's consent in advance and announce this policy for their protection.
The processing of personal data, such as name, address, e-mail address or telephone number, is always in accordance with the General Data Protection Regulation (GDPR) and is in accordance with the country-specific data protection regulations. With this data protection declaration we would like to inform you about the scope and purpose of the data we collect, use and process. Users are informed, through this declaration, about the protection of their personal data and about the rights they have under the Regulation.
“UNIVERSAL EXPRESS 2” Ltd. has implemented numerous technical and organizational measures to ensure the full protection of the personal data of individuals received and processed through our site.
1. Definitions
The data protection declaration of “UNIVERSAL EXPRESS 2” Ltd. is based on the terminology used in the General Data Protection Regulation (GDPR). The data protection declaration should be understandable to the general public as well as to our customers and business partners. To ensure this, we would first like to explain the terminology used.
In this data protection declaration we use the following terms:
1.1. Personal data
Personal data – any information that can be used to identify a natural person (“user”). A natural person who can be identified directly or indirectly, in particular by indicating data such as name, location data, online identifier and others.
1.2. Data Subject/User
A data subject ("user") is any identified or identifiable natural person whose personal data is processed by us under the terms of the Regulation.
1.3. Processing
Processing, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available or combining, restriction, erasure or destruction of personal data.
1.4. Restriction of processing
Restriction of processing is the marking of stored personal data with the aim of restricting their processing in the future.
1.5. Profiling
Profiling – any form of automated processing of personal data.
1.6. Supervisory authority / administrator
The controller or administrator responsible for the processing is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by the EU legal framework.
1.7. Recipient
The recipient is the natural or legal person, public authority, agency or other body to which the personal data are disclosed, whether or not it is a third party. Public authorities that may receive personal data in the framework of a specific investigation in accordance with EU law are not considered to be third parties; the processing of such data shall comply with the applicable data protection rules in accordance with the purposes of the processing.
1.8. Third party
Third party is a natural or legal person, public authority, agency or body other than the data subject, the controller, the processor and the persons who, under the direct authority of the controller or processor, are authorised to process personal data.
1.9. Consent
The user's consent is any freely, specific, informed and unambiguous indication, by a statement or by clear affirmative action, of his or her consent to the processing of his or her personal data.
2. Name and address
“UNIVERSAL EXPRESS 2” Ltd.
Sofia, 11A Vasil Drumev Street
Phone: +359895 43 10 10
Email: universalexpress@mail.bg
Website: www.saunaclubbg.com
Supervisory authority:
Personal Data Protection Commission with address: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd., tel.: 02 915 3519, e-mail: kzld@cpdp.bg: Website: www.cpdp.bg.
3. “Cookies”
The website www.saunaclubbg.com uses cookies. Cookies are text files that are stored on the user's device. Here you can read about our Cookie Policy.
4. Collection of general data and information
The website of “UNIVERSAL EXPRESS 2” Ltd. collects general data and information when visiting it. This general data and information is stored in the log files of the server, owned by "Superhosting.BG" Ltd., which strictly comply with the Personal Data Protection Regulation. Information about this can be found at https://www.superhosting.bg/web-hosting-page-terms-and-agreements.php#gdprThe collected information may include (1) the types and versions of the browser used, (2) the operating system used by the accessing system, (3) the site from which it reaches our website (so-called Referrers), (4) (5) the date and time of access to the website, (6) IP address, (7) the Internet service provider, (8) any other information that could be used in the event of a cyber attack on our website.
When using this general data and information, “UNIVERSAL EXPRESS 2” Ltd. does not draw any conclusions about the data subject. Rather, this information is necessary to: (1) create the correct content of our website, (2) optimize the content of our website, (3) ensure quality access to information, (4) provide law enforcement authorities with the necessary information for criminal prosecution in the event of a cyber attack.
That's why, “UNIVERSAL EXPRESS 2” Ltd. analyzes the anonymously collected data and information statistically in order to increase data protection and security, and to ensure an optimal level of protection for the personal data it processes. Anonymous data in the server log files is stored separately from any personal data provided by the user.
5. Possibility of contact through the site
The website of “UNIVERSAL EXPRESS 2” Ltd. contains information that allows quick electronic contact with us, as well as direct communication, which includes submitting direct information by e-mail, via a form on the site. If a user contacts “UNIVERSAL EXPRESS 2” Ltd. directly by e-mail or via the contact form, the personal data transmitted by the data subject are automatically stored. Such personal data transmitted voluntarily by the user are processed and stored for the purpose of contacting him. These personal data are not provided to third parties.
6. Deletion and blocking of personal data
“UNIVERSAL EXPRESS 2” Ltd. processes and stores the user's personal data only for the period necessary to achieve the purpose, or for a period provided for in the Regulation.
If the storage purpose is not applicable or if the storage period specified by the European legislator or another competent legislator expires, the personal data are routinely blocked or erased in accordance with legal requirements.
7. Consumer rights
7.1. Right to confirmation
Each user has the right to obtain from us confirmation as to whether personal data concerning him or her are being processed. If a data subject wishes to exercise this right of confirmation, he or she may at any time contact us.
7.2. Right of access
Every user has the right to obtain information about their personal data stored at any time, as well as a copy of this information. In addition, according to the Regulation, the user has the right to request access and information about:
– the purposes of the processing;
– the categories of personal data concerned;
– the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
– where possible, the intended period for which the personal data will be stored;
– the right to request rectification or erasure of personal data or restriction of processing of personal data;
– the right to lodge a complaint with a supervisory authority;
– the existence of automated decision-making, including profiling, referred to in Article 22, paragraphs 1 and 4 of the Regulation, as well as the envisaged consequences of such processing.
The user has the right to obtain information about whether his/her personal data is transferred to a third country or an international organization. When this is the case, the user has the right to be informed about the safeguards taken in relation to the transfer.
If a user wishes to exercise this right of access, he or she may contact us at any time.
7.3. Right to rectification
Each user has the right to request, without undue delay, the rectification of inaccuracies in his/her personal data. Taking into account the purposes of the processing, the user has the right to have incomplete personal data completed by providing a supplementary statement to that effect.
If the user wishes to exercise this right to rectification, he or she may contact us at any time.
7.4. Right to erasure
Every user has the right to request the erasure of their personal data without delay and we are obliged to erase them without undue delay where one of the following grounds applies:
– the personal data are no longer necessary in relation to the purposes for which they were collected or processed;
– the user withdraws the consent on which the processing of his/her personal data is based, pursuant to Article 6, paragraph 1a or Article 9, paragraph 2a of the Regulation, and where there is no other legal reason for continuing to process them;
– the user objects to the processing pursuant to Article 21(1) of the Regulation and there are no legitimate grounds for the processing or the user objects to the processing pursuant to Article 21(2) of the Regulation;
– the personal data has been unlawfully processed;
– the personal data are collected in connection with the provision of services referred to in Article 8, paragraph 1 of the Regulation;
If one of the above reasons applies and the user wishes to request the deletion of personal data stored by “UNIVERSAL EXPRESS 2” Ltd., he or she can contact us at any time. An employee of “UNIVERSAL EXPRESS 2” Ltd. will immediately ensure that the deletion request is complied with immediately.
Where the controller has made the personal data public, it shall be obliged, pursuant to Article 17(1), to erase the personal data provided to third parties, taking into account available technology and the cost of implementation, to take reasonable steps, including technical measures, to inform other controllers processing the personal data that the user has requested erasure. The employees of the “UNIVERSAL EXPRESS 2” Ltd. will organize the necessary actions for each individual case.
7.5. Right to restrict the processing of personal data
Each user has the right to request restriction of the processing of their personal data when one of the following applies:
– the accuracy of the personal data is contested by the user, giving the administrator the opportunity to verify their accuracy;
– the processing is unlawful and the user's data opposes the rules for their deletion and instead requests the restriction of their use;
– it is no longer necessary to process the personal data, but they are required for the establishment, exercise or defense of legal claims;
– the user objects to the processing of his/her personal data, pursuant to Article 21, paragraph 1 of the Regulation.
If one of the above conditions is met and the user requests the restriction of the processing of their personal data stored by “UNIVERSAL EXPRESS 2” Ltd., he or she can contact us at any time. The employee of “UNIVERSAL EXPRESS 2” Ltd. will limit their processing.
7.6. Right to data portability
Each user has the right to receive the personal data concerning him or her, which he or she has provided to us, in a structured electronic format. The user has the right to transmit these data to another controller, provided that the processing is based on Art. 6, paragraph 1a, Art. 9, paragraph 2a of the Regulation or on a contract pursuant to Art. 6, paragraph 1b of the Regulation.
Furthermore, when exercising the right to data portability pursuant to Article 20(1) of the Regulation, the user has the right to provide personal data directly from one controller to another, where this is technically feasible in accordance with the Regulation.
To establish the right to data portability, the User may contact us at any time.
7.7. Right to object
Every user has the right to object at any time to the processing of personal data concerning him or her on the basis of Article 6, paragraph 1 of the Regulation.
“UNIVERSAL EXPRESS 2” Ltd. will not process personal data in the event of an objection unless we have compelling reasons for the processing which override the interests, rights and freedoms of the user or for the establishment, exercise or defence of legal claims.
If “UNIVERSAL EXPRESS 2” Ltd. processes personal data for direct marketing purposes, the user has the right to object at any time to their processing for this purpose. This applies to profiling related to direct marketing. If the user does not wish their data to be processed for direct marketing purposes, we are obliged to comply with this request.
7.8. Automated decision-making, profiling
Each user has the right to object to automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him, as long as the decision is not necessary for entering into or performing a contract between us and the user.
7.9. Right of withdrawal
Each user has the right to withdraw his or her consent to the processing of his or her personal data at any time. If the user wishes to withdraw his or her consent, he or she may contact us at any time.
8. Data protection provisions regarding the use of Google Analytics on our website
We have integrated a Google Analytics script into our website. The purpose of this tool is to collect and analyze data about the behavior of website visitors: which pages were visited, how often and for how long a given subpage was viewed. Web analytics is mainly used to optimize the website and possibly to perform an analysis of the costs and benefits of online advertising.
Google Analytics is owned by Google Inc., 1600 Pkwy, Mountain View, CA 94043-1351, USA.
For web analytics via Google Analytics, we use "_gat. _anonymizeIp". With the help of this application, the IP address of the user's Internet service provider is shortened by Google and anonymized.
For more information, please see our Cookie Policy.
9. Data protection provisions regarding the use of Facebook
On our site we have links to the social network Facebook.
A social network is a place for online meetings on the Internet, an online community where users are allowed to communicate with each other and interact in a virtual space. A social network can serve as a platform for exchanging opinions and experiences, or allow users to provide personal or business information. Facebook allows users to create profiles, upload photos, and make contacts with each other.
Facebook is owned by Facebook, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA. If the user lives outside the United States or Canada, the controller of personal data is Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, in Ireland.
It is possible that on every page of our website there is a link to our Facebook profile and/or installed Facebook plugins. It is possible that the device from which the user visits our website may invite him to install an additional setting and/or the Facebook mobile application. An overview of all possible Facebook plugins can be found at https://developers.facebook.com/docs/pluginsDuring this procedure, Facebook is notified of which subpage of our site was visited by the user.
If the user is also logged into Facebook, Facebook detects this and collects information that is associated with the user's profile on the social network. If the user clicks on one of the Facebook links/buttons integrated into our site, the social network stores this information that is associated with the personal user profile there.
Facebook always receives information about the visit to our site when the user is logged into the social network system, regardless of whether the user clicks on any of the Facebook links on our site or not. If the user does not wish such transmission of information to Facebook, it is advisable for the user to log out of their account on the social network before visiting our site.
Facebook's privacy guide is published on https://facebook.com/about/privacy, where information is provided on the collection, processing and use of personal data by the social network. It also explains what possible settings Facebook offers to protect the privacy of the user's personal data. Various configuration options are described that prohibit the transmission of data to Facebook.
10. Data protection provisions regarding the application and use of YouTube
On our website we have links and/or videos that download directly into the content of one or more subpages on our site, directly from YouTube. YouTube is an internet video portal that allows free posting and viewing of videos. YouTube allows posting of all types of videos, as well as access to entire films, television shows, music videos and videos created by users through the internet portal.
YouTube is owned by YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA and is a subsidiary of Google Inc.
It is possible that when you visit one or more pages of our site, predefined videos from the portal may be automatically downloaded and displayed. Additional information about YouTube can be found at https://www.youtube.com/yt/about/en/When downloading video content, YouTube and Google receive information about which specific subpage of our website was visited by the user.
If the user is logged in to YouTube, YouTube recognizes the user account and receives information about the duration and which specific pages the user visited. This information is collected by YouTube and associated by Google with the respective user profile on YouTube.
YouTube and Google will only receive information that the user has visited our website if the user is logged in to YouTube; this is regardless of whether the user clicks on a link or a video on YouTube or not. If such a transmission of information to YouTube and Google is not desired by the user, this can be prevented by logging out of their account on the video portal before visiting our website.
YouTube's data protection provisions can be found at https://www.google.com/intl/bg/policies/privacy/.
11. Data protection provisions regarding the application and use of Instagram
We have integrated components and links to the Instagram service. Instagram is a service that can be classified as an audiovisual platform that allows users to share photos and videos, as well as distribute them to other social networks.
Instagram is owned by Instagram LLC, 1 Hacker Way 14, Menlo Park, California, USA.
When visiting any of the pages of our website, an internet site, there is an integrated Instagram component, which may send information to the social network about user behavior on any of the pages of our website and/or you may receive an invitation to install a component or mobile application of the social network.
If the user is simultaneously logged into Instagram, Instagram records the duration and visits to each page of our site and associates this behavior with the user's account on the social network. This information is collected regardless of whether the user clicks on any of the social network buttons on our site or not.
Further information and the applicable data protection provisions of Instagram can be found at https://help.instagram.com/155833707900388 and https://www.instagram.com/about/legal/privacy.
12. Data protection provisions regarding the application and use of Pinterest
This website has integrated components of Pinterest Inc. Pinterest is a social network – a meeting place, an online community that allows users to communicate and interact with each other in a virtual space. The social network can serve as a platform for exchanging opinions and experiences or allow the Internet community to provide personal or company information. Pinterest allows users of the social network to publish collections of pictures and individual photos, as well as descriptions on virtual pinboards (so-called Pins), which can be shared by other users (so-called Comment).
Pinterest is owned by Pinterest Inc., 808 Brann St., San Francisco, CA 94103, USA.
When visiting our website, each subpage on which a Pinterest component (Pinterest plug-in) is integrated, the internet browser on the user's device may send an explicit invitation to install a component or the mobile application of the social network. Additional information about Pinterest can be found at https://pinterest.comPinterest receives information about which specific subpage was visited by the user.
If the user is logged in to Pinterest, Pinterest tracks the browsing of each subpage of our site and associates this information with the user's profile on the social network.
The data protection guide published by Pinterest, which is available at https://about.pinterest.com/privacy-policy , provides information about the collection, processing and use of personal data by Pinterest.
13. Data protection provisions regarding the application and use of LinkedIn
Our site has settings and links to and from LinkedIn. LinkedIn is a web-based social network that allows users with existing business contacts to connect and create new business contacts. Over 400 million registered users in more than 200 countries use LinkedIn. Thus, LinkedIn is currently the largest platform for business contacts and one of the most visited websites in the world.
LinkedIn is owned by LinkedIn Corporation, 2029 Stierlin Court Mountain View, CA 94043, USA. For matters related to the protection of personal data for citizens of the European Union, it is responsible for Wilton Plaza, Wilton Place, Dublin 2, in Ireland.
When following a hyperlink on a page that contains a link to LinkedIn, the browser on the user's device may automatically download relevant settings and add-ons from LinkedIn and/or an invitation to install the social network's mobile application. Additional information about all possible LinkedIn add-ons can be found at https://developer.linkedin.com/pluginsDuring this/these processes, LinkedIn obtains information about exactly which subpage a respective add-on was downloaded from, if such a setting is available on the visited page of our website.
If the user is logged into their LinkedIn user account, LinkedIn tracks user behavior such as the duration of the visit and exactly which pages of our website are visited. This information is collected by the LinkedIn plug-ins and associated with the user's respective LinkedIn profile. If the user clicks on one of the LinkedIn buttons integrated on our website, LinkedIn saves this information in the user's profile.
LinkedIn receives information about visits and duration of our site, regardless of whether the user follows the links to the social network on our site or not, if he is logged into the social network system. If the user does not want this type of information to be transmitted to the social network, he must log out of his account there before visiting our site.
LinkedIn allows you to manage notifications. https://www.linkedin.com/psettings/guest-controls The user has the ability to opt out of email messages, SMS messages and targeted advertising, as well as the ability to manage ad settings. LinkedIn also uses Eire, Google Analytics, BlueKai, DoubleClick, Nielsen, Comscore, Eloqua and Lotame. The setting of such cookies can be refused with the guidelines published on https://www.linkedin.com/legal/cookie-policyThe applicable LinkedIn privacy policy is available at https://www.linkedin.com/legal/privacy-policyLinkedIn's Cookie Policy is available at https://www.linkedin.com/legal/cookie-policy.
14. Legal basis for processing personal data
Art. 6, paragraph 1b of the Regulation serves as the legal basis for the processing of personal data, obtaining consent from the user for a specific purpose of processing his personal data. If the processing of personal data is necessary for the performance of a contract to which the data subject is a party, as is the case, for example, where processing operations are necessary for the supply of goods or the provision of services, the processing is based on Art. 6, paragraph 1a of the Regulation. The same applies to processing that is necessary to carry out pre-contractual measures, for example in the case of inquiries about our products or services. The legal basis on which the processing of personal data is required, for example for the performance of tax operations, the processing of personal data is based on Art. 6, paragraph 1b of the Regulation. In rare cases, the processing of personal data may be necessary to protect the vital interests of the user or of another natural person. The processing of personal data may be based on Art. 6, paragraph 1b of the Regulation. This legal basis is used for processing in cases where the basis for processing does not fall within the scope of any of the above-mentioned legal bases, if the processing is necessary for the purposes of our legitimate interests or those of a third party, unless such interests are overridden by the fundamental rights and freedoms of the user.
15. Legitimate interests pursued by the controller or by a third party
Where the processing of personal data is based on Article 6(1) of the Regulation, the lawful basis under which we process personal data is to enable us to provide quality services for the benefit of current and future customers.
16. Period for which personal data will be stored
The criteria used to determine the period of storage of personal data are the legal frameworks provided for in the Regulation. After the expiry of the period specified in the Regulation, the relevant data are deleted according to established rules if they are no longer necessary for the performance of a contract or for the emergence of a contract between the two parties.
The provision of personal data upon the emergence of a contractual relationship between us and the user, their processing and storage, as well as the rights arising from the Regulation are defined in this Privacy Policy.
We clarify that the provision of personal data may be partially required by law (e.g. tax legislation) or may be the result of contractual relationships that have arisen. If it is necessary to conclude a contract, the user must provide his personal data for this purpose, which will be processed by us in accordance with the procedure established by the Regulation. Refusal to provide personal data may result in the impossibility of concluding a contract, delivery of services or goods on our part.
English 
Bulgarian