Privacy Policy

Operated by WATERPROOF IDEAS

Last updated: 20 July 2026
Contact: office@50best.bg
Website: https://50best.bg

1. Introduction and Scope

At 50 Best Products from Bulgaria, we respect your privacy and are committed to protecting your personal data.

This Privacy Policy explains how WATERPROOF IDEAS, as the organization operating the 50 Best Products from Bulgaria initiative (the “Platform”, “Initiative”, “we”, “us”, or “our”), collects, uses, stores, shares, and protects personal data.

It also explains your rights and the measures we take to ensure that personal data is processed lawfully, fairly, transparently, and securely.

This Privacy Policy applies to:

Individuals and organizations submitting applications or nominations;
Applicants’ representatives and contact persons;
Jury members, evaluators, and industry experts;
Advisory Board members;
Winners, finalists, and nominees;
Sponsors, institutional partners, and business partners;
Event participants, speakers, and invited guests;
Newsletter subscribers;
Website visitors and individuals contacting the Initiative.

Our personal data processing activities are governed by:

Regulation (EU) 2016/679 – the General Data Protection Regulation (GDPR);
The Bulgarian Personal Data Protection Act (Закон за защита на личните данни);
The Bulgarian Electronic Commerce Act (Закон за електронната търговия), where applicable;
The Bulgarian Electronic Communications Act (Закон за електронните съобщения), where applicable;
Other applicable Bulgarian and European Union legislation.

We process personal data only where we have an appropriate legal basis and for specified, legitimate purposes.

2. Identity and Contact Details of the Data Controller

For the purposes of applicable data protection legislation, the data controller is the legal entity operating the Initiative.

Data Controller: WATERPROOF IDEAS
Legal entity name: Waterproof Ideas
Company registration number (EIK/UIC): 208514906
Registered address: Bulgaria, Sofia, g.k. Iztok, ulitsa Akademik Metodi Popov 16-17
Project: 50 Best Products from Bulgaria
Website: https://50best.bg
Privacy contact email: office@50best.bg

WATERPROOF IDEAS determines the purposes and means of processing personal data in connection with the Initiative.

All inquiries concerning privacy, data protection, or the exercise of individual rights may be submitted to office@50best.bg.

Where a Data Protection Officer is legally required to be appointed, the relevant contact details will be published.

3. Principles of Personal Data Processing

We follow the principles established under Article 5 of the GDPR.

Lawfulness, fairness, and transparency: Personal data is processed lawfully and in a transparent manner.

Purpose limitation: Personal data is collected for specified, explicit, and legitimate purposes.

Data minimization: We collect only the information reasonably necessary to fulfill the relevant purpose.

Accuracy: We take reasonable measures to maintain accurate and up-to-date information.

Storage limitation: Personal data is retained only for as long as necessary, subject to applicable legal requirements.

Integrity and confidentiality: We implement appropriate technical and organizational measures to protect personal data.

Accountability: We maintain appropriate documentation and procedures to demonstrate compliance with applicable data protection obligations.

4. Categories of Personal Data We Collect

Depending on your relationship with the Initiative, we may collect and process the following categories of information.

4.1 Applicants and Nominated Organizations

When an individual or an authorized representative submits an application or nomination, we may process:

Full name;
Job title and professional position;
Company or organization name;
Business contact information;
Email address and telephone number;
Business address and country;
Product or service descriptions;
Application forms and supporting documents;
Photographs, videos, and promotional materials;
Relevant professional or business information;
Communications relating to the application;
Evaluation results and selection-related correspondence;
Billing details and transaction records.

Where business documents contain personal data, such information will be processed only to the extent necessary for the administration and evaluation of the application.

We do not require applicants to submit sensitive personal data unless there is a specific lawful and necessary reason.

4.2 Jury Members and Independent Evaluators

We may process:

Full name and professional title;
Organization and professional affiliation;
Professional biography and qualifications;
Business contact information;
Professional portrait photographs;
Public professional profiles;
Evaluation scores, comments, and assessments;
Conflict-of-interest declarations;
Confidentiality acknowledgments;
Relevant communications and participation records.

Evaluation information may be accessible to authorized organizers and individuals involved in the selection process.

Individual jury assessments will not be publicly disclosed unless a lawful basis exists and such disclosure is consistent with the applicable evaluation rules.

4.3 Advisory Board Members

We may process:

Full name;
Professional position and organizational affiliation;
Biography and professional experience;
Business contact information;
Portrait photographs;
Public statements and professional contributions;
Participation records and correspondence.

Where portraits, biographies, or statements are published, we will identify and document the appropriate legal basis, which may include consent or legitimate interests depending on the circumstances.

4.4 Winners, Finalists, and Selected Products

For the purpose of presenting and promoting selected products and organizations, we may process:

Names of representatives;
Professional positions;
Company and brand information;
Product descriptions;
Photographs and audiovisual content;
Interviews and public statements;
Award or recognition information;
Event-related materials;
Professional biographies and contact information, where appropriate.

Information may appear on the Initiative’s website, official social media accounts, press materials, award publications, event presentations, and promotional campaigns.

We will distinguish between personal data and information relating exclusively to legal entities, brands, and products.

4.5 Partners, Sponsors, and Service Providers

We may process:

Names of authorized representatives;
Business contact information;
Job titles;
Contract-related correspondence;
Billing information;
Information necessary to administer partnerships, sponsorships, and professional cooperation.

4.6 Website Visitors

When individuals visit our website, certain technical information may be collected, including:

IP address;
Browser type and version;
Device and operating system information;
Language preferences;
Date and time of website access;
Pages visited and interactions;
Referring website information;
Technical error and security logs;
Cookie identifiers and related information, where applicable.

Some information may be collected automatically through server logs and website technologies.

Non-essential tracking technologies will be used only where the required consent has been obtained.

4.7 Newsletter Subscribers

When you subscribe to communications from the Initiative, we may collect:

Email address;
Name, if provided;
Subscription preferences;
Consent records;
Subscription and unsubscribe dates;
Communication engagement data, where lawfully collected.

You may withdraw consent at any time.

4.8 Events and Public Activities

When you register for or participate in an event organized by the Initiative, we may process:

Name and professional affiliation;
Contact details;
Registration and attendance information;
Speaker or participant biography;
Photographs and video recordings;
Event-related correspondence.

Where events are photographed or recorded, we will provide appropriate information about the recording and identify the applicable legal basis for processing and publication.

Additional consent will be obtained where required.

5. Sources of Personal Data

We may receive personal data:

Directly from individuals completing forms or communicating with us;
From authorized representatives of participating organizations;
From nominations submitted by third parties;
From jury members, Advisory Board members, and partners;
From publicly accessible professional or business sources;
From event registrations and professional correspondence;
Through website technologies and service providers.

Where we obtain personal data indirectly, we will provide the information required by Article 14 of the GDPR unless a lawful exception applies.

Individuals submitting information about another person must have an appropriate basis for doing so and should inform that person where applicable.

6. Purposes and Legal Bases for Processing

We process personal data for the following purposes, subject to the legal bases established under Article 6 of the GDPR.

Receiving and administering applications – Contractual necessity or legitimate interests, as applicable.
Managing nominations and selection procedures – Legitimate interests or contractual necessity, as applicable.
Organizing jury evaluations – Legitimate interests or contractual necessity.
Communicating with applicants and representatives – Contractual necessity or legitimate interests.
Administering Advisory Board participation – Contractual necessity or legitimate interests.
Publishing winner and finalist information – Legitimate interests or consent, depending on the information and context.
Publishing optional portraits, testimonials, and promotional materials – Consent or another applicable lawful basis.
Processing participation fees – Contractual necessity.
Maintaining accounting and tax records – Legal obligation.
Managing partnerships and sponsorships – Contractual necessity or legitimate interests.
Organizing events and registrations – Contractual necessity or legitimate interests.
Sending promotional newsletters – Consent, or another basis where specifically permitted by applicable law.
Operating essential website functions – Legitimate interests or contractual necessity, as applicable.
Using non-essential analytics and marketing cookies – Consent.
Preventing fraud and maintaining security – Legitimate interests or legal obligation.
Responding to legal requests and disputes – Legal obligation or legitimate interests.
Establishing, exercising, or defending legal claims – Legitimate interests or another applicable legal basis.

Where processing is based on legitimate interests, we assess the necessity of the processing and balance those interests against the rights and freedoms of the individuals concerned.

Where consent is the legal basis, consent must be freely given, specific, informed, and unambiguous.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

7. Application and Evaluation Process

The Initiative collects application information to administer participation, assess eligible products and services, coordinate evaluations, and determine finalists and winners.

Authorized jury members may receive access to application materials necessary for their evaluations.

Jury members and evaluators are expected to comply with applicable confidentiality and conflict-of-interest requirements.

Evaluation records may be retained to document the integrity and consistency of the selection process and to respond to legitimate inquiries or disputes.

Automated decision-making: Unless expressly disclosed otherwise, final selection decisions are not made solely by automated processing that produces legal or similarly significant effects on individuals.

If such automated decision-making is introduced, we will provide the information and safeguards required under Article 22 of the GDPR.

8. Publicity, Awards, and Promotional Content

The Initiative is intended to recognize and promote products, services, businesses, and innovation connected with Bulgaria.

Accordingly, certain information relating to winners, finalists, participating organizations, and professional representatives may be made publicly available.

This may include:

Organization and brand names;
Product and service information;
Names and professional titles of representatives;
Official award results;
Approved photographs and videos;
Interviews, statements, and promotional content.

Publication of personal data will be limited to what is necessary and justified by the applicable lawful basis.

Where publication depends on consent, individuals may withdraw that consent at any time.

Where publication relies on legitimate interests, individuals may exercise their right to object in accordance with the GDPR.

Withdrawal or objection does not automatically require the removal of all materials previously distributed by independent third parties where we no longer control those materials.

We will assess removal requests in accordance with applicable law.

9. Payments and Financial Information

Participation fees and other applicable payments may be processed through authorized third-party payment service providers.

Where payment card processing is used:

Payment card information is handled by the relevant payment provider;
We do not intentionally collect or store complete payment card numbers or card security codes;
Payment processing is subject to the provider’s applicable security and privacy arrangements;
We retain necessary payment confirmations, invoices, and accounting records.

The applicable provider and its privacy information should be identified during the payment process.

Where payment providers process information as independent controllers, their own privacy policies also apply.

Financial and accounting records are retained for the periods required by Bulgarian and European Union legislation.

10. Disclosure and Sharing of Personal Data

We do not sell or rent personal data to third parties.

We may share personal data with carefully selected recipients where necessary for the purposes described in this Privacy Policy.

Such recipients may include:

Hosting and IT service providers – For website hosting, technical maintenance, infrastructure, and security.
Email and communication providers – For transactional communications, newsletters, and administrative correspondence.
Payment service providers – For processing transactions and managing payment confirmations.
Jury members and evaluators – For assessing submitted applications and products.
Event and production partners – For managing events, awards ceremonies, and approved promotional activities.
Professional advisers – Including legal, accounting, auditing, and other advisers where reasonably necessary.
Public authorities – Where disclosure is required by law or a valid legal request.
Other partners – Where disclosure is necessary, lawful, and appropriately communicated.

Where a third party acts as our data processor, we will establish a processing agreement meeting the requirements of Article 28 of the GDPR.

Some recipients may act as independent controllers or joint controllers, depending on the nature of their involvement.

Where joint controllership exists, the required arrangements and information will be provided.

11. International Transfers of Personal Data

Personal data is primarily intended to be processed within the European Economic Area (EEA).

However, certain international service providers, jury members, or partners may be located outside the EEA.

Where personal data is transferred to a country outside the EEA, we will ensure that the transfer is supported by a lawful mechanism under Chapter V of the GDPR.

Such mechanisms may include:

An adequacy decision issued by the European Commission;
European Commission Standard Contractual Clauses (SCCs);
Additional technical, contractual, or organizational safeguards where necessary;
Another lawful transfer mechanism permitted by the GDPR.

Where required, we will assess risks associated with the destination country and implement supplementary safeguards.

Individuals may request further information about applicable transfer safeguards by contacting office@50best.bg.

12. Retention of Personal Data

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, unless a longer period is required or permitted by law.

The following periods describe our proposed retention framework and must reflect our actual operational practices.

Applicant information – Generally up to 3 years after the relevant edition.
Evaluation records – Generally up to 3 years after the relevant edition, subject to disputes or legal requirements.
Unsuccessful applications – Generally up to 3 years, unless a shorter period applies.
Winner and finalist public records – For as long as necessary for the Initiative’s legitimate archival and recognition purposes, subject to applicable rights.
Jury and Advisory Board records – For the duration of participation and generally up to 3 years thereafter, unless longer retention is justified.
Partnership and contractual records – For the contract duration and applicable limitation or statutory periods.
Accounting and financial records – For the periods required by Bulgarian law, commonly 10 years for relevant accounting records.
Newsletter subscriber information – Until withdrawal of consent or another applicable deletion event.
Contact inquiries – Generally up to 2 years after resolution, unless further retention is justified.
Technical and security logs – Generally up to 12 months, unless longer retention is necessary and lawful.
Cookie-related information – According to the retention periods disclosed in the Cookie Policy or consent interface.
Consent records – For as long as necessary to demonstrate compliance and address relevant legal claims.

Where data is required for ongoing legal proceedings, investigations, regulatory obligations, or the establishment, exercise, or defense of legal claims, retention may be extended as permitted by law.

After the applicable retention period, data will be securely deleted, anonymized, or otherwise handled in accordance with legal obligations.

13. Rights of Individuals

Under the GDPR, individuals have rights relating to the processing of their personal data.

These rights include:

13.1 Right of Access

You may request deletion of your personal data where the conditions under Article 17 of the GDPR are met.

This right is not absolute and may be restricted where continued processing is legally required or otherwise permitted.

13.2 Right to Rectification

You may request correction of inaccurate personal data and completion of incomplete information.

13.3 Right to Erasure

You may request deletion of your personal data where the conditions under Article 17 of the GDPR are met.

This right is not absolute and may be restricted where continued processing is legally required or otherwise permitted.

13.4 Right to Restriction of Processing

You may request restriction of processing in circumstances established by Article 18 of the GDPR.

13.5 Right to Data Portability

Where applicable, you may request personal data you have provided to us in a structured, commonly used, machine-readable format and request its transmission to another controller.

13.6 Right to Object

You may object to processing based on legitimate interests, including profiling associated with such processing.

You have the right to object at any time to processing of your personal data for direct marketing purposes.

13.7 Right to Withdraw Consent

Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

13.8 Rights Related to Automated Decision-Making

Where applicable, you have rights concerning decisions based solely on automated processing that produce legal or similarly significant effects.

13.9 Right to Lodge a Complaint

You have the right to lodge a complaint with a competent data protection supervisory authority.

In Bulgaria, the relevant authority is:

Commission for Personal Data Protection (CPDP)
Комисия за защита на личните данни (КЗЛД)

Website: https://www.cpdp.bg

You may also seek judicial remedies in accordance with applicable law.

14. Exercising Your Rights

To exercise your data protection rights, please contact:

office@50best.bg

Your request should describe the right you wish to exercise and provide sufficient information to enable us to identify the relevant personal data.

Where necessary and proportionate, we may request additional information to verify your identity.

We will respond without undue delay and generally within one month of receiving your request.

Where permitted under Article 12 of the GDPR, this period may be extended by up to two additional months due to the complexity or number of requests. We will inform you of the extension and the reasons for it within the initial one-month period.

Requests are generally handled free of charge, subject to the exceptions permitted by the GDPR.

15. Information Security

We implement technical and organizational measures appropriate to the nature of the personal data and the risks associated with processing.

Depending on the relevant systems and services, these measures may include:

HTTPS and TLS encryption for data transmitted through the website;
Appropriate encryption and security controls for stored data;
Role-based access restrictions;
Authentication and account protection measures;
Confidentiality obligations for authorized personnel;
Security monitoring and vulnerability management;
Secure backup and recovery procedures;
Access reviews and system maintenance;
Appropriate contractual safeguards with service providers;
Procedures for identifying, assessing, and responding to personal data breaches;
Periodic review of security practices.

No internet-based service or electronic storage system can be guaranteed to be completely secure.

Nevertheless, we take reasonable and proportionate steps to protect personal data against unauthorized access, accidental loss, unlawful disclosure, alteration, or destruction.

16. Personal Data Breaches

Where a personal data breach occurs, we will assess its nature, scope, potential consequences, and risks to affected individuals.

Where notification to the supervisory authority is required under Article 33 of the GDPR, we will notify the competent authority without undue delay and, where feasible, within 72 hours after becoming aware of the breach.

Where a breach is likely to result in a high risk to the rights and freedoms of individuals, we will notify affected individuals without undue delay, unless a lawful exception applies.

We will document personal data breaches and take appropriate corrective and preventive measures.

17. Cookies and Similar Technologies

Our website may use cookies and similar technologies to provide essential functionality, remember user preferences, understand website performance, and support permitted communications.

Cookies are small data files stored on your device when you visit a website.

17.1 Strictly Necessary Cookies

These cookies support functions essential to operating the website, including security, session management, and remembering privacy preferences.

Where legally exempt from consent requirements, these cookies may be used without prior consent.

17.2 Analytics Cookies

Analytics cookies help us understand how visitors interact with the website, such as which pages are visited and how the website performs.

Where legally required, these technologies will be activated only after obtaining consent.

17.3 Functional Cookies

Functional cookies may remember optional settings and preferences to improve the website experience.

Where consent is legally required, they will not be activated before consent is obtained.

17.4 Marketing Cookies

Marketing cookies may be used to measure advertising effectiveness or provide personalized promotional content.

Marketing cookies are not currently intended to be used by the Initiative.

If such technologies are introduced, this policy and the relevant consent mechanisms will be updated before their activation.

17.5 Cookie Consent and Management

Where required, visitors will be provided with a cookie consent interface allowing them to:

Accept non-essential cookies;
Reject non-essential cookies;
Choose between available cookie categories;
Review and change their preferences;
Withdraw previously given consent.

Rejecting non-essential cookies will not prevent access to essential website functionality.

Visitors may also manage cookies through their browser settings.

Further information about individual cookies, providers, purposes, and retention periods should be provided in a separate Cookie Policy or detailed cookie preference interface.

18. Electronic Communications and Newsletters

We may send administrative and service-related communications necessary for the operation of the Initiative.

These may include application confirmations, evaluation-related notices, payment confirmations, event information, and important operational updates.

Marketing communications, promotional newsletters, and optional announcements will be sent only where a lawful basis exists under applicable data protection and electronic marketing legislation.

Where consent is required:

Subscription will be voluntary;
Consent will be separate from unrelated application or contractual conditions;
We will maintain appropriate consent records;
Subscribers may withdraw consent at any time;
Promotional emails will include an unsubscribe mechanism.

Withdrawal of marketing consent will not prevent us from sending communications necessary to fulfill contractual or legal obligations.

19. Social Media and Third-Party Websites

The Initiative may maintain official profiles on social media platforms and publish information through external websites or digital services.

When you interact with these platforms, the relevant third-party providers may process your personal data under their own privacy policies.

We do not control all processing activities conducted independently by third-party platforms.

Where we and a platform act as joint controllers for particular activities, we will provide relevant information about the arrangement as required by law.

Our website may contain links to third-party websites.

We encourage visitors to review the privacy policies of those websites before submitting personal information.

20. Children’s Personal Data

The Initiative is primarily intended for business representatives, professionals, entrepreneurs, and other adult participants.

We do not knowingly collect personal data from children where such processing would be unlawful.

Where consent is relied upon for an information society service offered directly to a child, the applicable age requirements under Bulgarian law will be respected.

If we become aware that personal data relating to a child has been collected without an appropriate legal basis, we will take reasonable steps to address the situation, including deletion where required.

Parents or legal guardians may contact office@50best.bg with relevant concerns.

21. Special Categories of Personal Data

We do not ordinarily seek to collect special categories of personal data within the meaning of Article 9 of the GDPR.

These categories include information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric information used for unique identification, health information, and information concerning sex life or sexual orientation.

Applicants and other participants should avoid submitting such information unless specifically requested for a legitimate and lawful purpose.

If special category data is received, we will assess whether an appropriate Article 9 condition and an Article 6 legal basis exist.

Where no lawful basis exists, we will take appropriate steps to delete or otherwise lawfully handle the information.

22. Data Protection by Design and by Default

We aim to incorporate data protection principles into the design and operation of our systems, application procedures, and organizational processes.

This includes:

Limiting the collection of unnecessary personal data;
Restricting access to authorized individuals;
Reviewing new processing activities for privacy risks;
Applying appropriate retention and deletion procedures;
Selecting service providers with suitable security and privacy practices;
Conducting data protection impact assessments where required;
Reviewing and improving our data protection practices.

23. Mandatory and Optional Information

Certain personal data may be necessary to submit an application, participate in the evaluation process, receive services, or comply with legal obligations.

Where required information is not provided, we may be unable to process an application, complete a transaction, or provide a requested service.

Other information, including optional marketing subscriptions or certain promotional materials, may be provided voluntarily.

We will distinguish mandatory information from optional information where appropriate.

24. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

Changes in applicable legislation;
Changes in our processing activities;
Changes in website functionality;
New services or technologies;
Updated organizational or security practices;
Regulatory guidance or requirements.

The most recent version will be published on the official website of 50 Best Products from Bulgaria.

Where changes materially affect how personal data is processed, we will provide additional notice where required by applicable law.

Where a new processing purpose requires consent, we will obtain the necessary consent before beginning that processing.

25. Contact Information

For questions, requests, or concerns relating to this Privacy Policy or the processing of personal data, please contact:

WATERPROOF IDEAS
50 Best Products from Bulgaria

Email: office@50best.bg
Website: https://50best.bg
Registered address: Bulgaria, Sofia, g.k. Iztok, ulitsa Akademik Metodi Popov 16-17
Company registration number (EIK): 208514906

We are committed to handling personal data responsibly and respecting the rights of all individuals who interact with the Initiative.