2. Who we are ?
We are the largest Film Production Studio in Eastern Europe, providing film production, casting, visual effects and other art related services to clients in the EU, USA and all over the world.
When we say we, our, us, or the Group, we are referring to Nu Boyana Film AD (registered seat: Kinocentur Boyana area, Sofia 1616, Bulgaria and company registration number 831905091) and its subsidiaries Worldwide FX EOOD, (registered seat: Kinocentur Boyana area, Sofia 1616, Bulgaria and company registration number 201830734), Boyana Events OOD (registered seat: 84 Kumata str., Kinocentur Boyana area, Sofia 1616, Bulgaria and company registration number 204195489), B2Y OOD (registered seat: 84, Kumata str., Kinocentur Boyana area, Sofia 1616, Bulgaria and company registration number 203726677 and affiliates, all of whom are “controllers” of your personal data for the purposes of the Bulgarian Data Protection Act and the EU General Data Protection Regulation 2016/679 (GDPR) (the Act and GDPR together the Data Protection Legislation).
3. What personal data we may collect ?
3.1. We may collect on our websites (email, telephone, post and in person) and process the following personal data from you:
- information that you provide by filling in forms on our websites, for example, your name, country, email address, telephone number. This includes information provided at the time of registering to use our websites, subscribing to news and updates, posting comments or requesting products and services (including stages and facilities) ;
- if you apply for job with us, you can share a CV and a cover letter for the purpose of getting hired for the provision of various film related services. We need a wide range of specialists, actors, visual artists, workers, make-up and hairstyles, drivers etc. so it is up to you to decide what personal data would be relevant to share with us, depending on the type of job you are applying for;
- if you apply for our film and other vocational training classes or internship programs we will collect the following data : your name, contact detail and video record of you (acting for film classes), if you join our classes we will also collect your full name, personal identification number (if you do have one), address, identity card details, 2 photos, diplomas and a health document;
- if you apply for filmmaking or other challenges organized by the Group we will collect the following data : names, email, crew members, your reasons to participate. This includes information provided by filling the application forms for the challenges
- if you register to receive our newsletter, we will ask you to provide your email address to maintain contacts and regularly inform you about news, events and job opportunities;
- details of your visits to our websites including, but not limited to, traffic data, location data, weblogs and other communication data and the resources that you access;
- we may also ask you to complete surveys that we use for research purposes, although you do not have to respond to them;
- we may receive information about you from your agent or employer if they are a client/customer, tenant or contractor of or to the Group;
- we may also ask you for information when you report a problem with our websites;
- we also anonymise, collect, use and share aggregated data for statistical and research purposes where it does not identify you
- if you contact us, we may keep a record of that correspondence for security purposes
3.2. If you conclude a contract with us, we will also collect certain personal identifying data, for example, your name and contact details, ID card. Depending on the type of the contract we conclude with you, we may also collect other type of personal data about you, including information about your professional experience, photos and videos of you, description of your physical characteristics, special skills-sets, “sensitive” information related to your ethnic and racial origin and health condition. We will collect such “sensitive” information for you if you are also an aspiring actor who takes part in our castings/auditions.
3.3. If you visit our film studios center in Sofia, we will collect your name, surname and date of birth. There are also 24/7 CCTV cameras at the premises of the film studio.
4. Data processing purposes and legal basis
4.1. Based on your affirmative consent that you have given by submitting your request or filling in some of our forms in the websites we use personal data held about you for the following purposes:
- to provide you with products and services (including stages and facilities) that you request
from us, or information about them where you have asked to be contacted for such purposes;
- if you contact us to send you tailored information and offers and to contact you in relation to any service we provide;
- where you have registered your interest as an artist, contractor, supplier, challenge participant or you have applied for a job or internship – to assess your application and consider your suitability, to contact you in relation to your enquiry and to add you to our databases so we can contact you about potential auditions and jobs that may be of interest;
- to notify you about changes to our service and in certain circumstances, to contact you with information about goods and services which we feel may interest you by post, telephone or other electronic means (e-mail or SMS) (see the section on ‘Marketing’ below for further information). The provision of this information is entirely voluntary and you may withdraw your consent at any time or object to receiving marketing communications (see more information about your rights in section 11).
4.2. Based on our legitimate interests to administer the websites and to interact with users we may collect your data:
- to ensure that content from our websites is presented in the most effective manner for you
and for your computer;
- to allow you to participate in interactive features of our service, when you choose to do so;
- to maintain the security of our websites.
4.3. If you have entered into contract with us, we will use the data you have provided us which is necessary for the performance of the contact to perform the contract and carry out our obligations arising from it. In some instances, there may be some statutory requirements about the data we are obliged to collect. If you do not provide us with this information, we may not be able to conclude or perform the contract. After anonymizing the data, we may use it also for statistical and research purposes.
4.4. If you have taken part in castings/auditions, on the grounds of your consent, we will use your data with a view to hiring you in our productions or to share your data with other international film studios and film-producers that may be interested to hire you based on your explicit consent. Your participation in the casting and the provision of your personal information is entirely voluntary and you may withdraw your consent at any time (see more information about your rights in section 11). You must be aware though that if you do not provide us with this information we may not be able to assess your suitability and therefore to offer you or facilitate others to offer you a role.
4.5. If you visit our Film studios, we will collect, on the grounds of our legitimate interest to ensure the security of the premises of our studios. If you refuse to provide us with these details at the entrance of the film studio, the guard may decline to let you in.
4.6. If you have entered into any contract with us or provided us somehow with your contact details, we may send you marketing communications related to our services and goods based on your consent to promote and improve our services’ quality and accessibility to our existing and potential future clients, partners and film-production staff. You can opt out or object to receiving such information and marketing communications by clicking on the link “unsubscribe” below each marketing message you receive or by sending us an e-mail with text “no marketing communications” to email@example.com For more information about marketing, see point 6 below.
5. IP addresses and cookies
5.1. When you access our websites, we may collect information about your computer including, where available, your IP address, operating system and browser type for system administration and to report aggregate information to our advertisers. This is statistical data about our websites users’ browsing actions and patterns and does not identify any individual.
5.2. For the same reason, we may obtain information about your general internet usage by using a cookie file which is stored on the hard drive of your computer. Cookies are small text files which contain information that is transferred to your computer’s hard drive. They help us to improve our Websites and to deliver a better and more personalised service. They enable us to:
- estimate our audience size and websites usage patterns;
- store information about your preferences and so allow us to customise our websites according to your individual interests;
- speed up your searches; and
- recognise you when you return to our websites.
6.1. We would like to provide you with information about our news and most recent services which may be of interest to you, so we may use your data to contact you for such marketing purpose by post, telephone or other electronic means (e-mail or SMS).
6.2. If you are a corporate user, we will send marketing communications to your company e-mail address unless you have opted out. We will give you the opportunity to opt out of receiving marketing communications from us when we first contact you. Also, you can change your marketing preferences at any time by clicking on the “unsubscribe” link in any of our marketing communications or by contacting us at firstname.lastname@example.org.
6.3. For non-corporate users, we will only send marketing communications to your personal e-mail
address or SMS messages if those communications relate to goods, services or opportunities which are similar to services we have already provided to you in the past or which you have expressed an interest in, or if you have consented to us contacting you in this way.
6.4. You have the right to ask us not to process your personal data for marketing purposes. We will
usually inform you (before collecting your personal data) if we intend to use your personal data for such purposes or if we intend to disclose your information to any third party for such purposes. You can exercise your right to prevent such processing by checking certain boxes on the forms we use to collect your personal data. You can also exercise the right at any time by clicking on the “unsubscribe” link in any of our marketing communications or by contacting us at email@example.com
7. How do we protect personal data ?
7.1. All information you provide to us is stored on our secure servers. Where we have given you (or where you have chosen) a password which enables you to access certain parts of this websites or other websites managed by our Group, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.
7.2. If you decide to share your information with us through e-mail or our websites, you must be aware that our Group’s e-mails and websites are encrypted using SSL technology and provide secure data transmissions. Unfortunately, the transmission of information via other channels such as social media networks (e.g. Facebook, Instagram etc.) is not completely secure and we cannot guarantee the security of your data transmitted to us Any such transmission is at your own risk, so we strongly advise you to use our official websites and e—mails for any communication and sharing your personal information.
7.3. Once we have received your information, we will use strict procedures and security features to prevent unauthorised access and keep the information secure, confidential and integral.
We store all the documents and other devices containing personal data in secured storages in our premises with limited access, especially the data which contains “sensitive” information. Our information security systems and databases have also very high protection against external risks and we use very strict organizational and technical measures to prevent breaches in data security.
8. For how long do we keep your personal data ?
8.1. Depending on the purpose for which we have collected your data, we may keep it for different periods, but in any case, this will not be longer than what is needed for the purpose of the specific data processing. Including for the purposes of satisfying any legal, accounting or reporting requirements.
8.2. In general, we hold your information for 7 years after your last contact/correspondence in case of complaints or legal claims.
8.3. Where we have been using your personal data to provide you with marketing, we will retain this
information for 7 years and we will delete immediately your personal data following your request to be removed from our marketing list.
8.4. When you have sent us your CV and applied with us for a job, internship, vocational training classes, challenges we will retain this information for 3 years after you have submitted it, unless you have re-confirmed your interest in the meantime.
9. Disclosure of personal data
9.1. We may disclose your personal data to any member of our Group, which means our subsidiaries, if this is related to the service provided by them. In particular, if you request services from another Group company, we may need to pass your contact details on to that Group company.
9.2. We also share your personal data with the following third parties, who act as our data processors processing data on the basis of contracts that we have with them and which require them to fully comply with the Data Protection Laws and to keep your personal data secure and confidential:
- our websites hosting and maintenance provider;
- service providers who provide IT, software and system administration services;
- fulfilment service providers, for example e-mail marketing platforms, event invitation service providers, payment processors, accounting, insurance and legal services; and
- our third-party security supplier where you require access to Group premises or studio.
9.3. Occasionally, we may need to disclose your personal data to third parties where necessary for the legitimate interests of business or in order to comply with legal obligations:
- in the event we are obliged by law to disclose your data to public bodies;
- in the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets;
- if Nu Boyana Film AD, any of its subsidiaries or substantially all of their assets are acquired by a third party, in which case personal data held by it about its customers will be one of the transferred assets; or
10. Transferring your data to third countries
10.1. The personal data we collect from you may be transferred to, and stored at, a destination outside the European Union (EU) and the European Economic Area (EEA).
10.2. Our partners and clients are from all over the world. If you request services or sign up to events related to international productions and agreements, then this may involve the transfer of your personal data outside the EEA based on your explicit consent for this.
- you have explicitly given us your explicit consent for this (e.g. for casting purposes),
- There is an adequacy decision of the European Commission about the level of data protection provided by the third country;
- the transfer is necessary for the performance of a contract between you and our Group or the implementation of pre-contractual measures taken at your request;
- the transfer is necessary for the conclusion or performance of a contract between our Group and another natural or legal persons concluded in your interest;
- If the US providers are also certified under the EU-US Privacy Shield which confirms they have appropriate measures in place to ensure the protection of your personal data. If you would like further information, please contact firstname.lastname@example.org
11. Your Rights
11.1. In addition to the right to be informed about how we use your personal data (as set out in this
- Right to object: you can object to our processing of your personal data. Please contact us as noted above, providing details of your objection.
- Access to your personal data: you can request access to a copy of your personal data that we hold, along with information on what personal data we use, why we use it, who we share it with, how long we keep it for and whether it has been used for any automated decision-making.
- Right to withdraw consent: if you have given us your consent to use your personal data – for example, to send you marketing e-mails – you can withdraw your consent at any time by clicking the “unsubscribe” link in any marketing e-mail which you receive or by contacting us as at the e-mail address noted above.
- Rectification: you can ask us to change or complete any inaccurate or incomplete personal data held about you.
- Erasure: you can ask us to delete your personal data in certain circumstances, for example where it is no longer necessary for us to use it, you have withdrawn consent, or where we have no lawful basis for keeping it.
- Portability: if the processing of your data is based on a contract and performed through automatic means, you can ask us to provide you or a third party with the personal data that we hold about you in a structured, commonly used, electronic form, so it can be easily transferred to other service providers.
- Restriction: you can ask us to restrict the personal data we use about you in certain circumstances, for example, where you have asked for it to be erased or where you have objected to our use of it.
- Complaint: you can make a complaint about how we have used your personal data to us by contacting us as noted above, or file a complaint with the data protection supervisory authority for Bulgaria : Commission for Personal Data Protection at https://www.cpdp.bg/.
11.2. You should know that some of these rights only apply in certain circumstances and depending on the case, there may be some exceptions to them, so we may not be able to fulfill every request. If we receive a request from you to exercise any of the above rights, we may ask you to verify your identity before acting on the request; this is to ensure that your data is protected and kept secure.
11.3. If you wish to exercise any of these rights, please send us a written request by post or an e-mail to email@example.com through e-signature specifying your names, ID, contact details, your request and the reason for it.