Thank you for visiting our website and/or using our products or services. The protection and confidentiality of your personal data is of particular importance for us.
With this policy, we aim to inform you about the processing of personal data that we collect from our users and customers of our software products, services and website (https://www.chaos.com), hereinafter referred to as “the Products”, “the Services” or “the Website”. If you are one of our partners or resellers, this policy also tells you how we process the personal data of our contacts in your company.
Personal data covers all information related to an identified or identifiable individual. This includes information such as name, address, email, billing address or telephone number. Information that is not directly related to your identity, for example, the number of users on the Website does not fall within this category.
We provide additional information for residents of California below.
Who is responsible for the processing of your personal data?
The data controller in the sense of the GDPR and other national data protection laws of the member states as well as other data protection regulations is:
"Chaos Software" EOOD, UIC 131375768, a limited liability company incorporated under the laws of Republic of Bulgaria.
Address: 145 Tsarigradsko shose Blvd., Sofia Office Center, 12th floor, 1784 Sofia, Bulgaria.
In certain cases the immediate data controller may be "Chaos Software LTD" EOOD, UIC 204662149, having the same registered address at 145 Tsarigradsko shose Blvd., Sofia Office Center, 12th floor, 1784 Sofia, Bulgaria. Please note that "Chaos Software LTD" EOOD is a subsidiary, solely owned by "Chaos Software" EOOD, UIC 131375768 and together both companies will be referred to as "Chaos", “The Company” or “We”.
How to contact us?
If you have any questions and / or requests related to your personal data that the Company processes, you can contact us at: 145 Tsarigradsko shose Blvd., Sofia Office Center, 12th floor, 1784 Sofia, Bulgaria.
If you are based in the UK, you may also contact our UK data protection representative at: firstname.lastname@example.org.
You can contact our Data Protection Officer at the following email: email@example.com
Chaos respects the privacy of your personal information. The protection of your personal information throughout the entire process of processing personal data, as well as the security of all data processed by the Company, is an important issue for us. We process personally identifiable information collected during your visit to our Website and/or use of our Products and Services in accordance with national and European law.
Special Notice - if you are under 18 years old.
Our Products and Services are not aimed at children under 18 years old and we will not deliberately collect, use, provide or process in any other form any personal information of children under the age of 18. We therefore also ask you, if you are under 18 years old, please do not send us your personal information (for example, your name, address and email address). If we learn that we have collected personal data through our Products and Services from a child under 18 without the consent of the child’s parent or guardian as required by law, we will delete it.
What is “personal data”?
Any information and data by which an individual can be identified falls directly or indirectly under the definition of “personal data”.
For example, indirect identification is your mobile number. Direct identification is achieved when you provide a unique identifier such as Personal Identification Number (PIN), passport number, etc.
"Special categories of personal data" means data revealing racial or ethnic origin, political views, religious or philosophical beliefs or membership of trade unions, as well as the processing of genetic data, biometric data for the sole purpose of identifying an individual, health data or data about the sexual life or sexual orientation of the individual.
We collect personal data directly from you, for example when you create an account with us or contact us. We also collect data via automated means when you use our Products, Services or the Website, including usage data. We sometimes collect data from third parties, including our resellers and partners. This personal data may include the following categories:
|Categories of personal data||Types of personal data|
|Information about you||Name, surname, family name|
|Account information||Password, username|
|Contact details||Email, telephone number, fax|
|Personal identificators||Personal Identification Number (PIN) or other type of unique identification, required only for invoicing upon request of the customer|
|Information about your employer and your interests||Name of the company you work for and information about the industrial interest you have in software products (e.g. Film, VFX, Television, etc.)|
|Data about the persons who are eligible for discounts||Copy of documents evidencing that the person is an active student in an university|
|Address details||Billing address, country, city, ZIP and/or postcode|
|Bank data||Partial data about your bank account|
|Purchase history||Data about purchased or used Products or Services|
|Internet data||Data about your IP address, location data, cookie data, etc.|
|Copy of communication on our website||Copies of emails or other forms of communication you might have while using our Website, Products, Services and our communication system tools|
|Other data||Other types of personal information, which you may provide by contacting us and/or making a request / inquiry|
Chaos does not collect any special categories of personal data as such are not required for the use of our Website, Products or Services. If sensitive categories of personal data are provided by you in the course of your communication with the Company or use of our Website, Products or Services, it will be deleted as soon as possible after the processing of such data is established.
What are our legal grounds for processing of personal data?
The processing of personal data includes the collection, storage, destruction, transfer, correction, updating, deletion and all other activities carried out with your personal data.
Chaos processes personal data on the grounds of the performance of a contract with the customer (Article 6, paragraph 1, item "b" of the GDPR). We may also process personal data after obtaining clear, free and unambiguous consent from you for the purposes of processing expressed through your voluntary registration or provision of data in our Website, Products or Services (Article 6, paragraph 1, item “a” of the GDPR). The consent you provide can always be withdrawn by contacting us or using the contact form available on our website.
Some of our processing activities are based on legitimate interest (Article 6, paragraph 1, item “f” of the GDPR), but only after we have carefully assessed that such interests does not concern the fundamental rights and freedoms of the data subject.
Lastly, in very limited number of cases we process your personal data for compliance with a legal obligation to which Chaos is subject (Article 6, paragraph 1, item “c” of the GDPR).
For what purposes are we going to use your personal data?
The personal data provided by you shall be used for the following purposes, including but not limited to:
Your personal data is not subject to automated decision-making, including profiling, referred to in Article 22(1) and (4) of the GDPR.
How do we process your personal data?
When you visit the Website or use our Products and Services, Chaos processes (collects) your personal information in the following ways:
How long do we store your personal data?
Depending on the legal ground on which we process your personal data, the storage period of personal data may be different.
Your personal data is stored as long as we have valid legal grounds for processing it. After this period has expired and in case there is no legal ground to continue storing your personal data, your information shall be fully anonymized or deleted.
Do we share your personal data with third parties?
Chaos respects your privacy and keeps your data secured. Subject to statutory requirements or business needs, Chaos may disclose your personal data to the following categories of recipients:
Is your personal data shared in countries outside the European Union and the European Economic Area?
Some of our service providers, partners and distributors are located outside European Union (“EU”), the European Economic Area (“EEA”) and the United Kingdom(“UK”) including in the United States. Such countries may not offer your personal data the same level of protection as the laws in the EU, EEA or UK. Only in case one of our service providers, partners, affiliates and distributors are located or uses servers located outside of the EU or the EЕA we may transfer personal data outside of the said boundaries. However, in such cases Chaos shall ensure that adequate measures for protection of your personal data are in place and that the requirements of the GDPR are met before a cross-border transfer of personal data is executed. For more information about how we transfer Personal Data internationally, please contact us as set out in the “How to contact us“ section above.
What are your rights with respect to your personal data?
Subject to European law (GDPR), you may have the following rights to your personal data processed by Chaos:
You can exercise any of the above rights by submitting a formal request to the following address: 145 Tsarigradsko shose Blvd., Sofia Office Center, 12th floor, 1784 Sofia, Bulgaria, or email: firstname.lastname@example.org. In order to exercise your rights, it is mandatory to establish the identity of the claimant when submitting a request for exercising your rights. For your convenience we have created a policy for data subjects’ rights where you can find a lot more information about your rights related to data privacy and how to exercise them.
You also have the right to file a complaint with the Bulgarian Commission for Protection of personal Data (https://www.cpdp.bg/en/index.php?p=home&aid=0), or the data protection authority where you live, work or where you think we have violated data protection laws, when the relevant prerequisites are in place.
You may opt out of marketing-related emails by following the opt-out or unsubscribe instructions at the bottom of the email or by contacting us at email@example.com. You may continue to receive service-related and other non-marketing emails.
Additional information for users located in California
This section applies only to California residents.
Your California privacy rights. The CCPA grants individuals whose information is governed by the CCPA the following rights:
You are entitled to exercise the rights described above free from discrimination.
Please note that the CCPA limits these rights by, for example, prohibiting us from providing certain sensitive information in response to an access request and limiting the circumstances in which we must comply with a deletion request.
How users in California can exercise their rights
You may exercise your California privacy rights described above as follows:
Last updated: May 3, 2022
How to Control and Delete Cookies
To manage your Cookie preferences, click the button below:
There are a number of ways to limit online tracking, which we have summarized below:
Note that the above opt-out mechanisms are specific to the device or browser on which they are exercised. You will need to opt out on every browser and device that you use.
Do Not Track. Some Internet browsers may be configured to send “Do Not Track” signals to the online services that you visit. We currently do not respond to “Do Not Track” or similar signals. To find out more about “Do Not Track,” please visit http://www.allaboutdnt.com.
Cookies that Have Been Set in the Past
Collection of your data from our analytics cookies can be deleted. If cookies are deleted, the information collected prior to the preference change may still be used, however, we will stop using the disabled cookie to collect any further information from your user experience. For our marketing cookie, when a user opts out of tracking, a new cookie is placed to prevent users from being tracked.
For more information, feel free to contact our Data Protection Officer at firstname.lastname@example.org.
This Policy (“The Policy”) describes the terms and conditions under which data subjects whose personal data are processed by Chaos ("Chaos", “The Company”) may exercise their rights under the personal data protection legislation.
Part 1: General Principles
1.1. Chaos processes and protects personal data collected throughout its activities transparently, lawfully and according to the purposes for which the personal data were collected.
1.2. The employees who process personal data for the purposes of sale of software products and services or clients’ support to users and/or customers of Chaos as part of their employment relationship are obliged to adhere to the following principles of data processing:
i) The personal data are processed lawfully and in good faith;
ii) The personal data are collected for specific precise and lawful purposes and are not processed additionally in a manner not compatible with those purposes.
iii) The personal data which are collected and processed by Chaos are compatible, related to and limited to the purposes for which they are processed.
iv) The personal data are accurate and, if necessary, updated.
v) The personal data are being deleted or rectified when it is established that they are inaccurate or not limited for the purposes for which they are being processed.
vi) Personal data are maintained in a format, which allows identifying of the respective natural person for a period not longer than the one necessary for the purposes for which the data were collected.
1.3. The employees who process personal data are subject to an initial and periodic data privacy training and are familiarized with the applicable data privacy legislation.
Part 2: Definitions
The terms listed below shall have the following meaning:
“Personal data” means any information relating to an identified or identifiable natural person (‘data subject’). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
“Applicable legislation” means the legislation of the European Union (EU) and in particular the legislation of Republic of Bulgaria, which is applicable towards the personal data protection.
“Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements;
“Data subject” means an individual (natural person) who can be identified directly or indirectly, in particular by an identifier such as name, identification number, location data, online identifier or one or more physical, physiological, genetic, mental, economic, cultural or social identifiers of that individual
“Regulation (EU) 2016/679“ or “GDPR” means Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
Part 3: Data subjects’ rights
The data subjects shall have the following rights regarding to their personal data processed by Chaos:
i) Right of access;
ii) Right of rectification;
iii) Right to data portability;
iv) Right of erasure (‘right to be forgotten’);
v) Right to restriction of processing;
vi) Right to object against the processing of personal data;
vii) Right not to be subject to a decision based solely on automated processing, including profiling.
Right of Access
2.1. When requested Chaos shall present to the data subject the following information:
i) information whether Chaos processes personal data of the data subject who made the request or not;
ii) copy of the personal data of the person which are processed by Chaos and
iii) explanation about the processed personal data
2.2. The explanation under item 2.1. (iii) above shall include the following information about the personal data processed by Chaos:
i) purposes of processing;
ii) respective categories of personal data;
iii) recipients or categories of recipients to which personal data is or may be disclosed, in particular recipients in third countries outside of the EU or the European Economic Area;
iv) when it is possible, the envisaged retention period for which the personal data shall be retained and when this is impossible the criteria used for determining such period;
v) the existing of the rights to require correction, rectification, erasure or restriction of processing of personal data related to the data subject as well as the right to object against the processing of personal data;
vi) the right to file a complaint before the respective authorities;
vii) when the personal data are not collected through the individual full information shall be provided about the source of the collected personal data;
viii) the existence of automated decision making regardless of which this processing includes profiling and information related to the logic as well as the expected consequences from this processing to the data subject;
ix) when personal data is transferred to a third country or to an international organization the data subject shall have the right to be informed about the applicable safeguards to his/hers personal data related to the transfer
3.1. Based on a request by the data subject Chaos may provide a copy of the personal data, which The Company is processing about the respective data subject.
3.2. When providing a copy of personal data Chaos shall not disclose to the subject the following categories of data:
i) personal data of third parties, unless the said parties have given their explicit consent for this;
ii) data which can be qualified as trade secret, intellectual property or confidential information;
iii) other information which is protected under the applicable legislation
3.3. Granting the right of access to data subjects shall not interfere negatively to the rights of third parties or lead to a breach of Chaos’ statutory obligation.
4.1. When the requests for access are being manifestly unfounded or excessive, especially because of their repeatability, Chaos may charge a reasonable fee based on the administrative costs of providing the information or refuse to respond to the request for access.
4.2. Chaos determines on a case-by-case basis whether a request for access is manifestly unfounded or excessive.
4.3. When refusing access to personal data, Chaos issues an official explanation for its refusal and informs the data subject of his right to file a complaint with the Personal Data Protection Commission (CPDP) in Bulgaria.
Right of rectification
5.1. Data subjects may request that their personal data processed by Chaos be corrected if the data are inaccurate or incomplete.
5.2. Upon a satisfactory request for correcting personal data, Chaos shall notify the other recipients to whom personal data have been disclosed (such as government bodies, service providers) so that they can reflect the changes.
Right of erasure (‘right to be forgotten’)
6.1. Upon request, Chaos shall erase all personal information of the data subject who made the request in case any of the following grounds apply:
i) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
ii) the data subject withdraws consent on which the processing is based and where there is no other legal ground for the processing;
iii) the data subject objects to the processing and there are no overriding legitimate grounds for the processing;
iv) the data subject objects to the processing of personal data for the purposes of direct marketing;
v) the personal data have been unlawfully processed;
vi) the personal data must be erased for compliance with a legal obligation in Union or Member State law to which Chaos is subject;
vii) the personal data have been collected in relation to the offer of information society services referred to in Article 8(1) of the GDPR.
6.2. Chaos is not obliged to erase and may continue processing the personal data as long as the processing is necessary for one of the following grounds:
i) for exercising of the right of freedom of expression and information;
ii) for compliance with a legal obligation of Chaos;
iii) for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) as well as Article 9(3) of the GDPR;
iv) or archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing ; or
v) for the establishment, exercise or defense of legal claims.
Right to restriction of processing
7.1. The data subject has the right to request a restriction of processing when one of the following applies:
i) the accuracy of the personal data is contested by the data subject, for a period enabling Chaos to verify the accuracy of the personal data;
ii) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
iii) Chaos no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defense of legal claims;
iv) the data subject has objected to processing based on the legitimate interest of Chaos pending the verification whether the legitimate grounds of the controller override those of the data subject;
7.2. Chaos may process personal data whose processing is restricted only for the following purposes:
i) storage purposes
ii) if explicit consent is provided by the data subject;
iii) or the establishment, exercise or defense of legal claims;
iv) for the protection of the rights of another natural or legal person ; or
v) or reasons of important public interest of the Union or of a Member State
7.3. When a data subject has requested a restriction of the processing and there is one of the grounds under Art. 7.1. above, Chaos informs the data subject before the restriction of the processing is lifted.
Right to data portability
8.1. The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to Chaos, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where.
8.2. Upon request, the personal data may be transferred to another administrator designated by the data subject where this is technically feasible.
8.3. The data subject may exercise the right of portability in the following cases:
i) the processing is based on the consent of the data subject;
ii) the processing is based on a contractual obligation;
iii) the processing is carried out by automated means.
8.4. The right of data portability cannot adversely affect the rights and freedoms of others.
Right to object
9.1. The data subject shall have the right to object against the processing of his/hers personal data by Chaos if the data are processed based on one of the following grounds:
i) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
ii) processing is necessary for the purposes of the legitimate interests pursued by Chaos;
iii) the processing includes profiling
9.2. Chaos shall no longer process the personal data when the right to object is exercised by a data subject unless the Company demonstrates compelling legitimate grounds for the processing, which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims.
Right to object against processing for the purposes of direct marketing
10.1. Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.
10.2. Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.
Right of human intervention in the process of automated decision making
11.1. Where Chaos uses automated decision making, regardless of whether it includes profiling and this decision making process have legal consequences for, or significantly affect natural persons, in a similar way, such persons may request a review of the decision with human intervention and express their point of view.
11.2. Chaos provides information to natural persons subject to automated decision making about the logic as well as the meaning and envisaged consequences of such processing when a request for such information is made.
Part 4: Procedure for exercising the rights of data subjects
12.1. All data subjects may exercise the rights under this Policy by submitting a request for the exercise of the relevant right.
12.2. Requests to exercise the data subjects’ rights shall be made in one of the following manners:
i) By email to the following email address email@example.com
ii) At the office of Chaos
iii) By mail to the following address: 145 Tsarigradsko shose Blvd., Sofia Office Center, 12th floor, Sofia Bulgaria, 1784.
12.3. The request for the exercise of rights relating to the personal data of the data subject should contain the following information:
12.3. Chaos provides information on the actions taken in relation to a request for the exercise of the rights of the data subjects within one month of the receipt of the request.
12.4. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. Chaos shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay.
12.5. Chaos is not obliged to respond to a request if it is unable to identify the data subject.
12.6. Chaos may request the provision of additional information necessary to verify the identity of the data subject when there are reasonable concerns about the identity of the requesting individual.
12.7. Where the data subject makes the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject.