Chaos

Privacy Policy

Privacy policy

Thank you for visiting our website and/or using our products or services. The protection and confidentiality of your personal data is of particular importance for us.

With this policy, we aim to inform you about the processing of personal data that we collect from our users and customers of our software products, services and website (https://www.chaos.com), hereinafter referred to as “the Products”, “the Services” or “the Website”. If you are one of our partners or resellers, this policy also tells you how we process the personal data of our contacts in your company.

Personal data covers all information related to an identified or identifiable individual. This includes information such as name, address, email, billing address or telephone number. Information that is not directly related to your identity, for example, the number of users on the Website does not fall within this category.

We respect the privacy of all users, customers and business contacts. This Privacy Policy describes the ways and conditions under which we process and use your personal data. We recommend that you read this Privacy Policy to get more information about the processing of your personal data.

Governing law applicable to this Privacy Policy is the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (‘General Data Protection Regulation’ or ‘GDPR’), the Bulgarian law, and the California Consumer Privacy Act.

We provide additional information for residents of California below.

Who is responsible for the processing of your personal data?

The data controller in the sense of the GDPR and other national data protection laws of the member states as well as other data protection regulations is:

"Chaos Software" EOOD, UIC 131375768, a limited liability company incorporated under the laws of Republic of Bulgaria. 

Address: 145 Tsarigradsko shose Blvd., Sofia Office Center, 12th floor, 1784 Sofia, Bulgaria.

Email: dpo@chaos.com 

In certain cases the immediate data controller may be "Chaos Software LTD" EOOD, UIC 204662149, having the same registered address at 145 Tsarigradsko shose Blvd., Sofia Office Center, 12th floor, 1784 Sofia, Bulgaria. Please note that  "Chaos Software LTD" EOOD is a subsidiary, solely owned by "Chaos Software" EOOD, UIC 131375768 and together both companies will be referred to as "Chaos", “The Company” or “We”.

How to contact us?

If you have any questions and / or requests related to your personal data that the Company processes, you can contact us at: 145 Tsarigradsko shose Blvd., Sofia Office Center, 12th floor, 1784 Sofia, Bulgaria. 

If you are based in the UK, you may also contact our UK data protection representative at: chaos@datarep.uk

You can contact our Data Protection Officer at the following email: dpo@chaos.com 

Chaos respects the privacy of your personal information. The protection of your personal information throughout the entire process of processing personal data, as well as the security of all data processed by the Company, is an important issue for us. We process personally identifiable information collected during your visit to our Website and/or use of our Products and Services in accordance with national and European law.

Special Notice - if you are under 18 years old.

Our Products and Services are not aimed at children under 18 years old and we will not deliberately collect, use, provide or process in any other form any personal information of children under the age of 18. We therefore also ask you, if you are under 18 years old, please do not send us your personal information (for example, your name, address and email address). If we learn that we have collected personal data through our Products and Services from a child under 18 without the consent of the child’s parent or guardian as required by law, we will delete it.

What is the nature of this Privacy Policy?

This Privacy Policy aims to provide you with comprehensive information in a clear and understandable language about what actions are taken with the personal data you provide to us, including:

  • What personal data do we process?
  • For what purposes do we process your personal data?
  • For how long do we keep the personal data you provide?
  • Whom we share your personal information with?
  • What are your rights regarding your personal data and how you can exercise them? 
  • How we notify you of a change to our Privacy Policy?

With this Privacy Policy, Chaos declares that it has implemented all technical and organizational measures to protect the personal data of individuals prescribed by law or regulation at national and European level.

What is “personal data”?

Any information and data by which an individual can be identified falls directly or indirectly under the definition of “personal data”.

For example, indirect identification is your mobile number. Direct identification is achieved when you provide a unique identifier such as Personal Identification Number (PIN), passport number, etc.

"Special categories of personal data" means data revealing racial or ethnic origin, political views, religious or philosophical beliefs or membership of trade unions, as well as the processing of genetic data, biometric data for the sole purpose of identifying an individual, health data or data about the sexual life or sexual orientation of the individual. 

We collect personal data directly from you, for example when you create an account with us or contact us. We also collect data via automated means  when you use our Products, Services or the Website, including usage data.  We sometimes collect data from third parties, including our resellers and partners. This personal data may include the following categories:

Categories of personal data Types of personal data
Information about youName, surname, family name
Account informationPassword, username
Contact detailsEmail, telephone number, fax
Personal identificatorsPersonal Identification Number (PIN) or other type of unique identification, required only for invoicing upon request of the customer
Information about your employer and your interestsName of the company you work for and information about the industrial interest you have in software products (e.g. Film, VFX, Television, etc.)
Data about the persons who are eligible for discountsCopy of documents evidencing that the person is an active student in an university
Address detailsBilling address, country, city, ZIP and/or postcode
Bank dataPartial data about your bank account
Purchase historyData about purchased or used Products or Services
Internet dataData about your IP address, location data, cookie data, etc.
Copy of communication on our websiteCopies of emails or other forms of communication you might have while using our Website, Products, Services and our communication system tools
Other dataOther types of personal information, which you may provide by contacting us and/or making a request / inquiry

We collect Personal Data via cookies, pixel tags, or similar technologies when you use our Products, Services or the Website (collectively referred to as “cookies”), including for conducting analytics and advertising. For more information on our use of cookies, please read our Cookie Policy. 

Chaos does not collect any special categories of personal data as such are not required for the use of our Website, Products or Services. If sensitive categories of personal data are provided by you in the course of your communication with the Company or use of our Website, Products or Services, it will be deleted as soon as possible after the processing of such data is established. 

What are our legal grounds for processing of personal data?

The processing of personal data includes the collection, storage, destruction, transfer, correction, updating, deletion and all other activities carried out with your personal data. 

Chaos processes personal data on the grounds of the performance of a contract with the customer (Article 6, paragraph 1, item "b" of the GDPR). We may also process personal data after obtaining clear, free and unambiguous consent from you for the purposes of processing expressed through your voluntary registration or provision of data in our Website, Products or Services (Article 6, paragraph 1, item “a” of the GDPR). The consent you provide can always be withdrawn by contacting us or using the contact form available on our website.

Some of our processing activities are based on legitimate interest (Article 6, paragraph 1, item “f” of the GDPR), but only after we have carefully assessed that such interests does not concern the fundamental rights and freedoms of the data subject.

Lastly, in very limited number of cases we process your personal data for compliance with a legal obligation to which Chaos is subject (Article 6, paragraph 1, item “c” of the GDPR).

For what purposes are we going to use your personal data?

The personal data provided by you shall be used for the following purposes, including but not limited to:

  • Administration and maintenance of our Website and the Chaos IDs of our customers and users;
  • Sale and support of Products and Services, which our customers and users decide to purchase or use;
  • Usage of aggregated data (not including personal data) about your use of Chaos’ Products and Services for the purposes of making all our products and services better;
  • Marketing and advertising activities, including to send you marketing by email and phone, if the legal requirements for digital marketing are met;
  • Processing of personal data for compliance with regulatory and other legal requirements;
  • Answering to claims and requests sent by our customers / users;
  • Processing orders or purchases made by our customers / users;
  • If you are a reseller or partner, communicating with you to manage our relationship;
  • Performance of rights and obligations related to our products, contractual or pre-contractual relationship with our customers / users;
  • Anticipating and resolving issues related to our Products or Services;
  • Creating new Products or Services that would meet your needs;

Your personal data is not subject to automated decision-making, including profiling, referred to in Article 22(1) and (4) of the GDPR.

How do we process your personal data? 

When you visit the Website or use our Products and Services, Chaos processes (collects) your personal information in the following ways:

  • by completing your account registration form on our Website 
  • by filling your required billing details;
  • by processing information about IP addresses, cookies, operating system and browser type.

How long do we store your personal data?

Depending on the legal ground on which we process your personal data, the storage period of personal data may be different.

Your personal data is stored as long as we have valid legal grounds for processing it. After this period has expired and in case there is no legal ground to continue storing your personal data, your information shall be fully anonymized or deleted. 

Do we share your personal data with third parties? 

Chaos respects your privacy and keeps your data secured. Subject to statutory requirements or business needs, Chaos may disclose your personal data to the following categories of recipients:

  • Service providers: When we use service providers related to client management systems, technical maintenance and provision of internal IT systems and operational support to our activities, Chaos may disclose personal data to those service providers. Please be informed that such disclosure shall commence only in case there are legitimate grounds for doing so and only based on a written agreement ensuring that the receiver provides adequate levels of protection for the personal data;
  • Our corporate partners and companies within our distribution network: Chaos Software uses a network of corporate partners and distributors who distribute our products and services in different jurisdictions and bundles. Therefore, we may disclose your personal data to a distributor who is in a suitable area with you in order to provide the best quality service.
  • Other companies in our corporate group: Chaos shares your data with other companies within its corporate group.
  • If we are involved in a merger, acquisition or asset sale, financing due diligence, reorganisation, bankruptcy, receivership, sale of company assets, or transition of service to another provider, your personal data may be transferred to a party involved in such arrangement.
  • External companies providing services related to card payments: Chaos uses external companies administering card payments when purchasing products and services provided by us. Your bank details may be shared with this external providers only in case there are legitimate grounds for doing so and only based on a written agreement ensuring that the receiver provides adequate levels of protection for the personal data;
  • State and municipal authorities: In the course of compliance with its legal obligations Chaos may be obliged to disclose personal data of its customers to state or municipal authorities;

Is your personal data shared in countries outside the European Union and the European Economic Area?

Some of our service providers, partners and distributors are located outside European Union (“EU”), the European Economic Area (“EEA”) and the United Kingdom(“UK”) including in the United States.  Such countries may not offer your personal data the same level of protection as the laws in the EU, EEA or UK. Only in case one of our service providers, partners, affiliates and distributors are located or uses servers located outside of the EU or the EЕA we may transfer personal data outside of the said boundaries. However, in such cases Chaos shall ensure that adequate measures for protection of your personal data are in place and that the requirements of the GDPR are met before a cross-border transfer of personal data is executed. For more information about how we transfer Personal Data internationally, please contact us as set out in the “How to contact us“ section above.

What are your rights with respect to your personal data?

Subject to European law (GDPR), you may have the following rights to your personal data processed by Chaos:

  1. Access your personal data that Chaos processes and get a copy thereof;
  2. In case of incompleteness or inaccuracy in the data that Chaos processes, your personal data will be corrected (right to rectification);
  3. Request the erasure of your personal data when the conditions are met. Such cases are if the purpose for which the data is collected is achieved, you have withdrawn your consent when the processing is based on consent and there is no other legal basis for processing, your data is being processed unlawfully processed, and others;
  4. In the cases specified by the law, you may require that the processing of your personal data is restricted;
  5. In the cases specified by the law, you may object to the processing of your personal data;
  6. Exercise your data portability rights and request that your data be provided in a structured, commonly used and machine-readable format;
  7. Withdraw your consent when processing your personal data is based on consent.

You can exercise any of the above rights by submitting a formal request to the following address: 145 Tsarigradsko shose Blvd., Sofia Office Center, 12th floor, 1784 Sofia, Bulgaria, or email: dpo@chaos.com. In order to exercise your rights, it is mandatory to establish the identity of the claimant when submitting a request for exercising your rights. For your convenience we have created a policy for data subjects’ rights where you can find a lot more information about your rights related to data privacy and how to exercise them.

You also have the right to file a complaint with the Bulgarian Commission for Protection of personal Data (https://www.cpdp.bg/en/index.php?p=home&aid=0), or the data protection authority where you live, work or where you think we have violated data protection laws, when the relevant prerequisites are in place.

You may opt out of marketing-related emails by following the opt-out or unsubscribe instructions at the bottom of the email or by contacting us at dpo@chaos.com. You may continue to receive service-related and other non-marketing emails.


Additional information for users located in California

This section applies only to California residents. 

Your California privacy rights. The CCPA grants individuals whose information is governed by the CCPA the following rights: 

  • Information. You can request information about how we have collected and used your personal data during the past 12 months. We have made this information available to California residents without having to request it by including it in this Privacy Policy.
  • Access. You can request a copy of the personal data that we have collected about you during the past 12 months.
  • Deletion. You can ask us to delete the personal data that we have collected from you.
  • Opt out of sale of your personal data. We do not sell personal data. Like many businesses, we use services that display interest-based ads to users around the web. You can limit online tracking by visiting the “Cookie settings” link in the footer of our homepage. We also offer instructions on how to limit online tracking in the Cookie policy

You are entitled to exercise the rights described above free from discrimination.

Please note that the CCPA limits these rights by, for example, prohibiting us from providing certain sensitive information in response to an access request and limiting the circumstances in which we must comply with a deletion request.  

How users in California can exercise their rights

You may exercise your California privacy rights described above as follows:

  • Right to information, access and deletion. You can request to exercise your information, access and deletion rights by:
    • Mailing us at [145 Tsarigradsko shose Blvd., Sofia Office Center, 12th floor, 1784 Sofia, Bulgaria]
    • Emailing dpo@chaos.com
  • Identity verification. We will need to confirm your identity and California residency to process your requests to exercise your information, access or deletion rights. We cannot process your request if you do not provide us with sufficient detail to allow us to understand and respond to it.
  • Authorized agents. California residents can empower an “authorized agent” to submit requests on their behalf. We will require the authorized agent to have a written authorization confirming that authority. 

Updating this Privacy Policy

This policy may be updated periodically to reflect changes in personal data protection legislation and best practices. Chaos undertakes to notify you of any material changes to this privacy policy, either via email or including a prominent notice on our Service.

Last updated: May 3, 2022

Cookie policy

This Cookie Policy tells you about how "Chaos Software" EOOD, UIC 131375768, and "Chaos Software LTD" EOOD, UIC 204662149, limited liability companies incorporated under the laws of Republic of Bulgaria (“Chaos”, “us”, “we”, or “our”) use cookies and similar technologies on our website and related services (together, the “Services”). This Cookie Policy should be read in conjunction with our Privacy Policy.

 

How to Control and Delete Cookies

To manage your Cookie preferences, click the button below:



There are a number of ways to limit online tracking, which we have summarized below:

  • Blocking cookies in your browser. Most browsers let you remove or reject cookies, including cookies used for interest-based advertising. To do this, follow the instructions in your browser settings. Many browsers accept cookies by default until you change your settings. For more information about cookies, including how to see what cookies have been set on your device and how to manage and delete them, visit allaboutcookies.org. Use the following links to learn more about how to control cookies and online tracking through your browser:
    • Firefox; Chrome; Microsoft Edge; Safari
  • Blocking advertising ID use in your mobile settings. Your mobile device settings may provide functionality to limit use of the advertising ID associated with your mobile device for interest-based advertising purposes.
  • Using privacy plug-ins or browsers. You can block our Services from setting cookies used for interest-based ads by using a browser with privacy features, like Brave, or installing browser plugins like Privacy Badger, DuckDuckGo, Ghostery or uBlock Origin, and configuring them to block third party cookies/trackers.
  • Advertising industry opt-out tools. You can also use these opt-out options to limit use of your information for interest-based advertising by participating companies:
    • Digital Advertising Alliance 
    • Network Advertising Initiative 
  • Platform opt-outs. The following advertising partners offer opt-out features that let you opt out of use of your information for interest-based advertising:
    • Google opt-out 
    • LinkedIn opt-out 
    • Microsoft opt-out 

Note that the above opt-out mechanisms are specific to the device or browser on which they are exercised. You will need to opt out on every browser and device that you use.

Do Not Track. Some Internet browsers may be configured to send “Do Not Track” signals to the online services that you visit.  We currently do not respond to “Do Not Track” or similar signals. To find out more about “Do Not Track,” please visit http://www.allaboutdnt.com.  

Cookies that Have Been Set in the Past

Collection of your data from our analytics cookies can be deleted. If cookies are deleted, the information collected prior to the preference change may still be used, however, we will stop using the disabled cookie to collect any further information from your user experience. For our marketing cookie, when a user opts out of tracking, a new cookie is placed to prevent users from being tracked.

Questions?

For more information, feel free to contact our Data Protection Officer at dpo@chaos.com.

Policy for data subjects’ rights

This Policy (“The Policy”) describes the terms and conditions under which data subjects whose personal data are processed by Chaos ("Chaos", “The Company”) may exercise their rights under the personal data protection legislation.

Part 1: General Principles

1.1. Chaos processes and protects personal data collected throughout its activities transparently, lawfully and according to the purposes for which the personal data were collected.

1.2. The employees who process personal data for the purposes of sale of software products and services or clients’ support to users and/or customers of Chaos as part of their employment relationship are obliged to adhere to the following principles of data processing:

i) The personal data are processed lawfully and in good faith;

ii) The personal data are collected for specific precise and lawful purposes and are not processed additionally in a manner not compatible with those purposes. 

iii) The personal data which are collected and processed by Chaos are compatible, related to and limited to the purposes for which they are processed.

iv) The personal data are accurate and, if necessary, updated.

v) The personal data are being deleted or rectified when it is established that they are inaccurate or not limited for the purposes for which they are being processed.

vi) Personal data are maintained in a format, which allows identifying of the respective natural person for a period not longer than the one necessary for the purposes for which the data were collected.

1.3. The employees who process personal data are subject to an initial and periodic data privacy training and are familiarized with the applicable data privacy legislation.

Part 2: Definitions

The terms listed below shall have the following meaning:

“Personal data” means any information relating to an identified or identifiable natural person (‘data subject’). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

“Applicable legislation” means the legislation of the European Union (EU) and in particular the legislation of Republic of Bulgaria, which is applicable towards the personal data protection.   

“Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements;

“Data subject” means an individual (natural person) who can be identified directly or indirectly, in particular by an identifier such as name, identification number, location data, online identifier or one or more physical, physiological, genetic, mental, economic, cultural or social identifiers of that individual

“Regulation (EU) 2016/679“ or “GDPR” means Regulation (EU) 2016/679  of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

Part 3: Data subjects’ rights

The data subjects shall have the following rights regarding to their personal data processed by Chaos:

i) Right of access;

ii) Right of rectification;

iii) Right to data portability;

iv) Right of erasure (‘right to be forgotten’);

v) Right to restriction of processing;

vi) Right to object against the processing of personal data;

vii) Right not to be subject to a decision based solely on automated processing, including profiling.

Right of Access

2.1. When requested Chaos shall present to the data subject the following information:

i) information whether Chaos processes personal data of the data subject who made the request or not;

ii) copy of the personal data of the person which are processed by Chaos and

iii) explanation about the processed personal data

2.2. The explanation under item 2.1. (iii) above shall include the following information about the personal data processed by Chaos:

i) purposes of processing;

ii) respective categories of personal data;

iii) recipients or categories of recipients to which personal data is or may be disclosed, in particular recipients in third countries outside of the EU or the European Economic Area;

iv) when it is possible, the envisaged retention period for which the personal data shall be retained and when this is impossible the criteria used for determining such period;

v) the existing of the rights to require correction, rectification, erasure or restriction of processing of personal data related to the data subject as well as the right to object against the processing of personal data; 

vi) the right to file a complaint before the respective authorities;

vii) when the personal data are not collected through the individual full information shall be provided about the source of the collected personal data;

viii) the existence of automated decision making regardless of which this processing includes profiling and information related to the logic as well as the expected consequences from this processing to the data subject;

ix) when personal data is transferred to a third country or to an international organization the data subject shall have the right to be informed about the applicable safeguards to his/hers personal data related to the transfer

2.3. The explanation about the processed personal data contains information which Chaos provides to the data subject by its privacy policy.

3.1. Based on a request by the data subject Chaos may provide a copy of the personal data, which The Company is processing about the respective data subject.

3.2. When providing a copy of personal data Chaos shall not disclose to the subject the following categories of data:

i) personal data of third parties, unless the said parties have given their explicit consent for this;

ii) data which can be qualified as trade secret, intellectual property or confidential information;

iii) other information which is protected under the applicable legislation

3.3. Granting the right of access to data subjects shall not interfere negatively to the rights of third parties or lead to a breach of Chaos’ statutory obligation.  

4.1. When the requests for access are being manifestly unfounded or excessive, especially because of their repeatability, Chaos may charge a reasonable fee based on the administrative costs of providing the information or refuse to respond to the request for access.

4.2. Chaos determines on a case-by-case basis whether a request for access is manifestly unfounded or excessive.

4.3. When refusing access to personal data, Chaos issues an official explanation for its refusal and informs the data subject of his right to file a complaint with the Personal Data Protection Commission (CPDP) in Bulgaria.

Right of rectification

5.1. Data subjects may request that their personal data processed by Chaos be corrected if the data are inaccurate or incomplete. 

5.2. Upon a satisfactory request for correcting personal data, Chaos shall notify the other recipients to whom personal data have been disclosed (such as government bodies, service providers) so that they can reflect the changes.

Right of erasure (‘right to be forgotten’)

6.1. Upon request, Chaos shall erase all personal information of the data subject who made the request in case any of the following grounds apply:

i) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

ii) the data subject withdraws consent on which the processing is based and where there is no other legal ground for the processing;

iii) the data subject objects to the processing and there are no overriding legitimate grounds for the processing;

iv) the data subject objects to the processing of personal data for the purposes of direct marketing;

v) the personal data have been unlawfully processed;

vi) the personal data must be erased for compliance with a legal obligation in Union or Member State law to which Chaos is subject;

vii) the personal data have been collected in relation to the offer of information society services referred to in Article 8(1) of the GDPR.

6.2. Chaos is not obliged to erase and may continue processing the personal data as long as the processing is necessary for one of the following grounds:

i) for exercising of the right of freedom of expression and information;

ii) for compliance with a legal obligation of Chaos;

iii) for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) as well as Article 9(3) of the GDPR;

iv) or archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing ; or

v) for the establishment, exercise or defense of legal claims.

Right to restriction of processing

7.1. The data subject has the right to request a restriction of processing when one of the following applies:

i) the accuracy of the personal data is contested by the data subject, for a period enabling Chaos to verify the accuracy of the personal data;

ii) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;

iii) Chaos no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defense of legal claims; 

iv) the data subject has objected to processing based on the legitimate interest of Chaos pending the verification whether the legitimate grounds of the controller override those of the data subject;

7.2. Chaos may process personal data whose processing is restricted only for the following purposes:

i) storage purposes

ii) if explicit consent is provided by the data subject;

iii) or the establishment, exercise or defense of legal claims;

iv) for the protection of the rights of another natural or legal person ; or

v) or reasons of important public interest of the Union or of a Member State

7.3. When a data subject has requested a restriction of the processing and there is one of the grounds under Art. 7.1. above, Chaos informs the data subject before the restriction of the processing is lifted.

Right to data portability

8.1. The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to Chaos, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where.

8.2. Upon request, the personal data may be transferred to another administrator designated by the data subject where this is technically feasible.

8.3. The data subject may exercise the right of portability in the following cases:

i) the processing is based on the consent of the data subject;

ii) the processing is based on a contractual obligation;

iii) the processing is carried out by automated means.

8.4. The right of data portability cannot adversely affect the rights and freedoms of others.

Right to object

9.1. The data subject shall have the right to object against the processing of his/hers personal data by Chaos if the data are processed based on one of the following grounds:

i) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

ii) processing is necessary for the purposes of the legitimate interests pursued by Chaos;

iii) the processing includes profiling

9.2. Chaos shall no longer process the personal data when the right to object is exercised by a data subject unless the Company demonstrates compelling legitimate grounds for the processing, which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims.

Right to object against processing for the purposes of direct marketing

10.1. Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.

10.2. Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.

Right of human intervention in the process of automated decision making

11.1. Where Chaos uses automated decision making, regardless of whether it includes profiling and this decision making process have legal consequences for, or significantly affect natural persons, in a similar way, such persons may request a review of the decision with human intervention and express their point of view.

11.2. Chaos provides information to natural persons subject to automated decision making about the logic as well as the meaning and envisaged consequences of such processing when a request for such information is made.

Part 4: Procedure for exercising the rights of data subjects

12.1. All data subjects may exercise the rights under this Policy by submitting a request for the exercise of the relevant right.

12.2. Requests to exercise the data subjects’ rights shall be made in one of the following manners:

i) By email to the following email address dpo@chaos.com

ii) At the office of Chaos

iii) By mail to the following address: 145 Tsarigradsko shose Blvd., Sofia Office Center, 12th floor, Sofia Bulgaria, 1784.

12.3. The request for the exercise of rights relating to the personal data of the data subject should contain the following information:

  1. Identification of the person beyond doubt - name and personal identification number (where applicable)
  2. Contact details: address, telephone, email
  3. Request - description of the request

12.3. Chaos provides information on the actions taken in relation to a request for the exercise of the rights of the data subjects within one month of the receipt of the request.

12.4. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. Chaos shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay.

12.5. Chaos is not obliged to respond to a request if it is unable to identify the data subject.

12.6. Chaos may request the provision of additional information necessary to verify the identity of the data subject when there are reasonable concerns about the identity of the requesting individual.

12.7. Where the data subject makes the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject.

 

Chaos
© 2024 Chaos Software. Todos los derechos reservados.