Why and to whom does this Privacy Policy apply?
NORDIC EXPRESS EOOD, with its registered office and correspondence address at 3 Dechko Yordanov Str., fl. 3, office 12, Krasno Selo , City of Sofia, p.c. 1618, Bulgaria, acts as the controller of the personal data and information that may identify you, which you provide to us or which we collect through the Company’s services and business activities. This information (“Personal Data”) is processed in accordance with this Privacy Policy.
This Privacy Policy applies to all users of our website and services, including individuals who browse the website, submit inquiries, request information, or use our services without registering, as well as those who have registered or subscribed to services provided by the Company.
The Company’s services are not intended for persons under the age of 16, and we do not knowingly collect personal data from such individuals.
1. What data is considered personal data?
Under Regulation (EU) 2016/679, personal data means any information relating to an identified or identifiable natural person (“data subject”). An identifiable natural person is a person who can be identified, directly or indirectly, by reference to identifiers such as a name, identification number, location data, online identifier, or one or more factors specific to that person’s physical, physiological, genetic, mental, economic, cultural, or social identity.
2. What types of personal data do we collect about you?
The Company may collect the following categories of personal data in connection with your use of our website and services:
A) Contact data: information you provide when submitting an inquiry, requesting property details, booking a consultation, subscribing to our newsletter, creating an account, or otherwise contacting us. This may include your name, email address, telephone number, country of residence, city, and any additional information you voluntarily provide.
B) Contractual and transaction-related data: information necessary for entering into or performing a contractual relationship with the Company in relation to real estate services. This may include identification details, correspondence address, permanent address, and other data required for the preparation, conclusion, and execution of agreements, where applicable.
C) Data shared via social media or third-party services: if you communicate with us through social media platforms or other third-party channels, we may process the information made available to us through those services, including your name, username, profile image, email address, and any content or messages you choose to share.
D) Website usage data: when you access or use the Company’s website, we may collect information related to your activity on the website. Cookies and similar technologies may be used to collect data such as pages visited, properties viewed, content interacted with, search activity, advertisements viewed, IP address, browser type, and device information. For more details, please refer to our Cookie Policy.
The Company does not intentionally collect sensitive personal data unless this is required by law, necessary for a specific service, and processed on a valid legal basis.
Our website and services may also contain links to third-party websites or platforms. The Company is not responsible for the privacy practices of such third parties, and users are encouraged to review their respective privacy policies.
3. How do we use your personal data?
The personal data collected by the Company may be used for the following purposes:
3.1. To provide the services of the Company;
3.2. To assess, analyze, and improve the services of the Company in line with your expectations and interests;
3.3. To improve your experience when using the Company’s website and services by providing content, property offers, and information that may be relevant to you;
3.4. To provide high-quality customer service, communicate with you, and respond to your inquiries, requests, or appointments;
3.5. To protect and preserve the rights and legitimate interests of the Company, including in cases where disclosure of personal data may be necessary for:
(i) the protection, exercise, or enforcement of the legal rights, privacy, safety, or property of the Company, its employees, representatives, partners, clients, or contractors;
(ii) the prevention of fraud, misuse, or unlawful activity; and
(iii) risk management and internal control purposes;
3.6. To take steps prior to entering into a contract and to perform contractual obligations between you and the Company;
3.7. To comply with applicable legal obligations, regulatory requirements, legal procedures, or lawful requests from public and governmental authorities;
3.8. To enable social media-related functions where available, if you log in through or connect your social media account to a service of the Company, or where you share content through social media features integrated into the website. This may include your username, profile image, likes, comments, and activity related to the social media services you use. Such information may also be shared with the relevant social media service provider;
3.9. With your prior consent, to send you offers, promotions, newsletters, market updates, and other marketing communications by email, phone, SMS, chat applications, or social media, relating to the services of the Company, real estate opportunities, partner offers, or related services in the property sector;
3.10. With your prior consent, to send you personalized marketing communications based on your interests, preferences, search behavior, and interactions with the Company’s website and services through electronic communication channels.
The Company may also use anonymized information, or information that no longer identifies users directly or indirectly as specific natural persons, for any lawful business purpose, including analysis, improvement of services, and sharing with third parties.
4. On what legal basis do we use your personal data?
The processing of your personal data for the purposes set out below is based on the following legal grounds:
- Section 3, points 3.1. to 3.5. of this Privacy Policy is based on the legitimate interests of the Company and is necessary for the provision of the requested services, the operation of the website, customer communication, service improvement, and the protection of the Company’s rights and interests;
- Section 3, point 3.6. of this Privacy Policy is based on the necessity to take steps prior to entering a contract with the Company and, where applicable, for the performance of a contract to which you are a party;
- Section 3, point 3.7. of this Privacy Policy is based on the Company’s legal obligations and is necessary for compliance with applicable legislation, regulations, and lawful requests from competent authorities;
- Section 3, points 3.8. to 3.10. of this Privacy Policy is based on your consent, which you may withdraw at any time without affecting the lawfulness of processing carried out before such withdrawal.
5. How do we process your personal data?
Your personal data is processed both by automated means and by manual procedures and is protected through appropriate technical and organizational security measures, considering the nature, scope, context, and purposes of the processing, as well as the risks involved. The Company implements appropriate administrative, technical, physical, and organizational safeguards designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.
6. Who has access to your personal data?
For the purposes set out in Section 3 of this Privacy Policy, the Company may share your personal data with the following categories of recipients:
A) third-party service providers engaged by the Company to carry out data processing activities or to provide supporting or maintenance services, including IT service providers, hosting providers, website administrators, consultants, experts, accountants, and legal advisers, where such access is necessary and permitted under applicable law;
B) affiliated entities, business partners, agents, or service providers acting as controllers or processors, where this is necessary for the provision of the Company’s services;
C) competent public authorities, regulatory bodies, courts, or other institutions, where disclosure is required under applicable law.
7. Is your personal data transferred abroad?
Your personal data may be transferred to countries within the European Economic Area and, where necessary for the provision of the Company’s services, to other countries in accordance with applicable law. In such cases, the Company will ensure that appropriate and adequate safeguards are in place to protect your personal data and that any transfer is carried out in compliance with applicable data protection legislation.
8. What are your rights in relation to your personal data?
In accordance with Regulation (EU) 2016/679 (GDPR), you have the right at any time to:
- obtain confirmation as to whether personal data concerning you is being processed, and, where that is the case, to access such personal data, as well as information regarding its content, source, purpose of processing, categories of recipients, storage period, and whether any automated decision-making is carried out;
- request the correction, updating, or amendment of inaccurate or incomplete personal data;
- request the deletion or anonymization of your personal data where:
- the data has been processed unlawfully;
- the data is no longer necessary for the purposes for which it was collected or processed;
- the Company is under a legal obligation to erase the data;
- you have objected to the processing and there are no overriding legitimate grounds for continuing such processing;
- request the restriction of processing of your personal data where:
- you contest the accuracy of the data, for a period enabling the Company to verify its accuracy;
- the processing is unlawful, but you do not wish the data to be erased;
- the Company no longer needs the personal data for the purposes of processing, but you require it for the establishment, exercise, or defense of legal claims;
- you have objected to processing based on legitimate interest, pending verification whether the Company’s legitimate grounds override yours;
- object to the processing of your personal data where such processing is based on legitimate interest, including for direct marketing purposes;
- request the erasure of your personal data without undue delay, where applicable under the law;
- receive an electronic copy of the personal data you have provided to us (“data portability”), where processing is carried out by automated means and is based on your consent or on the performance of a contract;
- withdraw your consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before such withdrawal;
- lodge a complaint with the competent supervisory authority.
You may submit any of the above requests to the contact details provided below. In your request, please include sufficient information to identify yourself and indicate clearly which right you wish to exercise.
Please note that, in certain cases, the Company may retain specific information where required by law or where necessary for the establishment, exercise, or defense of legal claims. In some situations, deletion of your data may not lead to the immediate removal of all information from backup systems or archived records, where retention is required for compliance, security, or legal purposes.
In addition, where your personal data is used for marketing purposes, you have the right at any time to object to such processing. If you no longer wish to receive marketing communications from us, you may unsubscribe by following the instructions included in our messages or by contacting us directly.
If the Company shares your personal data with affiliated entities or trusted partners for marketing purposes, you may also object to such sharing at any time by contacting us using the details set out in this Privacy Policy.
In all cases, the Company may request additional information to verify your identity before processing your request, in order to protect your personal data and ensure that it is not disclosed to unauthorized persons.
9. Retention periods of personal data
We will retain your personal data for the period necessary to fulfil the purposes for which it was collected, as described in this Privacy Policy. The following retention periods shall apply to the processing of your personal data for the purposes set out below:
- Personal data collected for the purposes set out in Section 3, points 3.1. to 3.7. of this Privacy Policy shall be retained for the duration necessary for the provision of the Company’s services or the performance of the contractual relationship with the Company, plus any additional period required under applicable law, including limitation periods for legal claims following the termination of the services or contractual relationship;
- Personal data collected for the purposes set out in Section 3, point 3.8. of this Privacy Policy shall be retained for the period necessary for the use of social media-related functions or integrations provided through the Company’s website or services;
- Personal data collected for the purposes set out in Section 3, points 3.9. to 3.10. of this Privacy Policy shall be retained for a period of up to 24 months from the date of collection or from the date of your last meaningful interaction with the Company, unless you withdraw your consent earlier.
At the end of the applicable retention period, your personal data will be deleted, anonymized, or aggregated, unless further retention is required or permitted under applicable law.
10. Updates to this Privacy Policy
The Company reserves the right to amend or update this Privacy Policy at any time and for any reason, including, but not limited to, changes in applicable legislation, regulatory guidance, official decisions, interpretations, or business practices related to the processing of personal data.
Any changes to this Privacy Policy will be announced in advance by being published on the Company’s website.
11. Contact
If you have any questions in relation to this Privacy Policy, please contact us at the following email address: office@smartstayinvestments.com