Privacy policy

Personal Data Protection Policy

The privacy and security of our users' personal data have always been of primary importance to us. We have therefore created this unified Personal Data Protection Policy for Medium Station (Mezhdinna Stantsia OOD, UIC 130484558, registered office at 22 Galichitsa Street, Lozenets District, Sofia). It describes how we collect, use, store, disclose and delete—or, more generally, process—your data. This policy enables us to provide the same high level of protection to all users of https://www.mediumstation.com/.

Collection and use of personal data.

Personal data means any information that can be used to identify an individual. You may be asked to provide personal information whenever you contact us or our partners in connection with our products and services. The Controller and its partners may share and use this information only in accordance with this Policy and all applicable legal requirements. Your personal data is processed primarily within the European Union and the European Economic Area. In rare cases processing may take place in third countries outside those territories. In all cases, your personal data is processed only for the period and purposes for which it was provided.

What personal data we collect:

When you contact us through our different channels, participate in events, prize draws or games, or subscribe to receive information from us, we may collect the following categories of personal data:

Using the contact form

When you send an enquiry through the website contact form, we collect the name or company name you provide, your email address, telephone number when supplied, selected topic, message content, and confirmations that you accept the applicable terms and privacy policy. We process this data to answer enquiries, consider complaints and provide the requested information or assistance. The legal basis is our legitimate interest in ensuring effective communication and user service.

Enquiries through a Google or Meta profile (for example Facebook)

If you choose to contact us through a Google or Meta profile, we may receive your name, email address, profile image when available and supplied by the platform, and the identifier associated with your profile. This data is used solely to make communication and access to our services easier. Processing is based on your consent and/or our legitimate interest in improving the user experience.

Subscribing to notifications about new events and services

When you subscribe for information about new events, initiatives or services, we collect your first and last name, telephone number and email address. The data is used to send the relevant notifications and is processed on the basis of your consent.

Participation in events organised by the company

When you register for one of our events, we process the personal data you provide during registration. The data is used to organise and deliver the event and to communicate with participants.

In certain cases, participant data may be shared with event partners for the purpose of making contact and creating professional opportunities, where this forms part of the stated objectives of the relevant event.

At public events, photography and video recording may take place and participants may appear as part of the general atmosphere and documentary coverage. Recording is based on the Controller's legitimate interest in documenting and promoting its events.

Purposes for processing personal data.

We process your personal data in order to respond to your enquiry.

We process your personal data to perform our obligations as a party to a contract for the sale of goods or services. We may periodically use it to send important communications, such as notifications about current or upcoming events, changes to the Terms and Conditions or other rules. Where a particular website function requires personal data, failure to provide it means that you will not be able to use that function. The legal basis is Article 6(1)(a), (b), (c) and/or (f) of the GDPR.

We process your personal data for marketing purposes so that, where you choose, you can receive information and advertising communications, including communications based on an analysis of your previous behaviour. The legal basis is Article 6(1)(a) and/or (f) of the GDPR.

If you have consented to participate in a particular event, competition, prize draw or game, we process the data you provide to administer that activity. The legal basis is Article 6(1)(a) and/or (f) of the GDPR.

When you contact us through a Google or Meta profile, we may receive your name, email address, profile image and the identifier associated with your profile, depending on the service you select. This data is used solely to provide access to our services. We do not have access to your password or other sensitive data.

Disclosure to third parties.

To fulfil the purposes described above or meet legal obligations, we may need or be required to disclose personal data you provide to our partners, suppliers of marketing, market research and user-behaviour analysis services, such as Google and Facebook, or to competent public authorities.

In every case, we ensure that third parties receive only the data necessary, subject to contractual safeguards and controls over compliance with security measures.

When you contact us through a Google or Meta profile, the relevant platform may process your personal data in accordance with its own privacy policies. We recommend reviewing those policies to understand how those identity providers use your data.

Responsibility for the lawfulness, accuracy and content of information sent rests entirely with the parties that share it. Medium Station retains technical data related to sending messages, such as date and time, solely for service maintenance and security purposes.

Protection of personal data.

The company applies appropriate technical and organisational measures to protect your personal data in accordance with Regulation (EU) 2016/679 (GDPR).

The measures we have implemented are intended to prevent unauthorised access, disclosure, alteration or destruction of personal data and to reduce the risk of data loss, misuse or unlawful processing.

Access to your personal data is limited to employees, partners and suppliers who need it to perform their duties. They process your data according to our explicit instructions and are bound by contractual confidentiality obligations.

Your personal data is retained only for as long as necessary and is then destroyed or anonymised, unless a legal requirement calls for a longer retention period.

The Controller also applies administrative, technical and physical safeguards to protect your personal data against loss, theft, misuse, unauthorised access, disclosure, alteration or destruction.

When you post in forums, chat rooms or social-network services, the personal information you share is visible to other users and may be read, collected or used by them. In those cases, you are responsible for the personal information you choose to provide.

Integrity and retention of personal data.

We retain your personal data for the period necessary to fulfil the specific purpose for which it is processed and then delete it, unless a legal provision requires us to retain it for longer.

Personal data retention periods

We retain your personal data only for the period necessary to achieve the purposes for which it was collected, as described in this Privacy Policy. When determining the specific retention period, we take into account:

the type and sensitivity of the data;

the volume of data and purpose of processing;

the potential risk of misuse or disclosure;

our legal obligations, including applicable limitation periods.

Main rules:

Processing based on consent:

Where we process your data on the basis of consent, for example for marketing, it is retained until you withdraw that consent. It is then deleted within a reasonable period unless another legal basis permits continued processing.

Withdrawal of consent and absence of another legal basis:

If we have no legal basis to continue processing after consent is withdrawn, your personal data will be deleted without undue delay.

Anonymisation:

In some circumstances, we may anonymise your data for statistical, research or analytical purposes. We may then use the information indefinitely because it no longer identifies you directly or indirectly.

Deletion when no longer required:

If we no longer require your data, we will delete or anonymise it by removing all elements that allow identification.

Rights of the data subject.

If you wish to withdraw consent, request rectification, object to processing or ask for deletion of your data (the right to be forgotten), send your request to dpo@mediumstation.com. To prevent misuse, such requests will be considered only when sent from the email address used in the contact form, and we reserve the right to request additional information to verify the identity of the applicant and data subject. We will respond within one month. If that period must be extended, we will inform you of the extension and the reasons for the delay. We may refuse manifestly unfounded or repetitive requests or requests that threaten another person's privacy. You also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection: kzld@cpdp.bg, 2 Prof. Tsvetan Lazarov Boulevard, Sofia 1592.

Terms and procedure for reporting breaches under the Bulgarian Whistleblower Protection Act.

If you wish to report a breach falling within the scope of the Bulgarian Whistleblower Protection Act and meet its requirements, you may report it to the person responsible for handling reports in one of the following ways:

By email to dpo@mediumstation.com;

By post to Medium Station, 22 Galichitsa Street, Lozenets District, 1164 Sofia, Bulgaria;

Orally, by arranging an appointment in advance on +359 894 777 851.

To make a written report, including by email to dpo@mediumstation.com, the reporting person should complete and send the statutory form to one of the addresses above, following the relevant instructions. Once a report is received, the responsible person checks whether it contains the information required by law. If information is missing, the reporting person is asked to correct the omissions within seven days of receipt. Every report is assessed for credibility. Reports outside the scope of the law, reports whose content provides no reasonable basis for credibility, and reports containing clearly false or misleading factual statements are not considered. In the latter case, the report is returned with instructions to correct the statements and a reminder of the reporting person's responsibility for making false accusations.