PRIVACY POLICY OF THE "THEATRUM" PLATFORM

Last updated: 28 October 2026
Effective from: 28 October 2026

I. General Provisions

1. This Privacy Policy (hereinafter "the Policy") contains the information that we are required to provide to you under Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter "the Regulation" or "GDPR") and the Personal Data Protection Act (hereinafter "ЗЗЛД").
2. The Policy applies to the processing of personal data in connection with the online platform "Theatrum", accessible at theatrumbg.com, including its subdomains (hereinafter "the Platform").
3. The Policy concerns the following categories of natural persons:
   1. visitors to the Platform;
   2. artists whose names, participation in productions and professional information are published on the Platform;
   3. persons who contact us by email or by other means.
4. The Policy does not apply to the websites of the theatres and of other third parties to which the Platform contains links. Those parties process your personal data independently and in accordance with their own policies.

II. Who Is the Controller of the Personal Data

5. The controller of the personal data is Ай Ви Ен Тех Лабс OOD (IVN Tech Labs Ltd.), UIC (ЕИК) 208800195, with its registered office and address of management at 8 Zheko Voyvoda St., Sofia 1756, Bulgaria, represented by Vladislav Ivanov (hereinafter "the Controller", "we" or "us").
6. Contact details for all matters relating to personal data:
   • email: [email protected];
   • correspondence address: 8 Zheko Voyvoda St., Sofia 1756, Bulgaria;
   • telephone: +359 88 274 7097.
7. The Controller has not designated a data protection officer, as it is not required to do so under Article 37 of the Regulation. You may address all questions and requests relating to the processing of your personal data to the contact details given above.

III. Definitions

8. For the purposes of this Policy:
   1. "Personal data" means any information relating to a natural person who is identified or can be identified, directly or indirectly.
   2. "Processing" means any operation or set of operations performed on personal data – collection, recording, storage, use, disclosure, erasure and others.
   3. "Processor" means a person who processes personal data on behalf of the Controller.
   4. "Data subject" means the natural person to whom the personal data relate.
   5. "Cookies" are small text files that are stored on the user's terminal equipment when a website is visited.

IV. What Personal Data We Process, for What Purposes and on What Legal Basis

A. Visitors to the Platform

9. Technical data on access to the Platform. On each visit, your browser automatically sends certain technical data: IP address, date and time of the request, the page requested, and the type and version of the browser and of the operating system.
   • Purpose: delivering the content of the Platform, ensuring its security and uninterrupted operation, and preventing abuse and attacks.
   • Legal basis: Article 6(1)(f) of the Regulation – our legitimate interest in keeping the Platform available and secure.
   • Retention period: the data are processed by the hosting and network protection providers (Section VII). The network protection provider retains them in its system logs for up to 31 days, and the hosting provider for up to 90 days, after which they are deleted automatically, unless they are needed for the investigation of a specific security incident. The hosting provider's system logs are stored in the United States of America (point 27).
10. Language choice and cookie choice. We store in your browser the language you have selected and your decision as to whether to allow analytics measurement.
    • Purpose: displaying the Platform in the selected language and respecting the choice you have made.
    • Legal basis: Article 4a(4) of the Electronic Commerce Act (ЗЕТ) (the storage is strictly necessary for the provision of the service explicitly requested) and Article 6(1)(c) of the Regulation – our obligation to be able to demonstrate the consent given.
    • Retention period: in accordance with the Cookie Policy.
11. Analytics measurement. Only if you have consented to analytics measurement do we carry out the two activities below. You may withdraw your consent at any time through the "Cookie settings" link at the bottom of every page, without affecting the lawfulness of processing carried out before the withdrawal.
    1. Measurement of loading speed (Web Vitals). Your browser sends to the Platform indicators of page loading speed – the value of the measurement, the navigation type, the language, the page type and the version of the Platform. Measurement is carried out on approximately one in every ten pages loaded. We do not record your IP address, the exact address of the page or any identifier by which your visits can be linked to one another.
       • Purpose: identifying and resolving problems with the performance of the Platform.
       • Legal basis: Article 6(1)(a) of the Regulation and Article 4a of the Electronic Commerce Act – your consent.
       • Retention period: up to 90 days.
       • Recipients: the data are not provided to third parties. They do not contain an IP address or a cookie identifier and are recorded solely in the hosting provider's system logs (Section VII).
    2. Audience analysis through Google Analytics. Your browser loads the Google Analytics 4 tool and sends it data on how you use the Platform (for example, which pages you visit and which links to the theatres' websites you follow), a pseudonymous identifier of your browser stored in the _ga and _ga_* cookies, and data about your device, browser and language. Addresses are sent without their search and filter parameters (that is, without the words you searched for). Google derives an approximate location (country and city) from your IP address without storing the IP address itself. The tool does not use Google signals, does not link the data to a Google account and does not use them for personalised advertising. We send Google no identifier that identifies you directly. Google processes the data on our behalf, and Google's support staff may access them only when we ask Google for help.
       • Purpose: understanding how the Platform is used, so that we can improve its content and structure.
       • Legal basis: Article 6(1)(a) of the Regulation and Article 4a of the Electronic Commerce Act – your consent. Before you give it, nothing is sent to Google and no cookie is set. On withdrawal, sending stops and the _ga cookies are deleted.
       • Retention period: 2 months in Google Analytics; the _ga cookies – in accordance with the Cookie Policy.
       • Recipients: Google Ireland Limited and its sub-processor Google LLC (points 25 and 27).
12. Images from the theatres' websites. Some of the images on the Platform (posters, production photographs, portraits) may be loaded directly from the website of the theatre concerned. In that case, your browser connects to the theatre's server, which receives your IP address and the technical data referred to in point 9 and processes them independently.

B. Persons Who Contact Us

13. When you write to us, we process your name, your email address and the content of the message, as well as any other data that you yourself choose to provide to us.
    • Purpose: responding to the enquiry, or examining a report or a request to exercise rights.
    • Legal basis: Article 6(1)(f) of the Regulation – our legitimate interest in responding to enquiries addressed to us, and, where a request to exercise rights is concerned, Article 6(1)(c) of the Regulation (legal obligation).
    • Retention period: until the matter is closed and for up to 3 years after the last correspondence, unless a longer period is necessary for the establishment, exercise or defence of legal claims.

V. Information for Artists Whose Data Are Published on the Platform

14. This Section contains the information required under Article 14 of the Regulation for artists whose personal data have not been obtained from the artists themselves.
15. What data we process: name (in Cyrillic and in Latin script), professional role (for example, "actor"), participation in productions and roles performed, portrait photograph, creative biography and year of birth, where the theatre has published such information. We do not process data revealing racial or ethnic origin, political opinions, religious beliefs, health status or other special categories of data under Article 9 of the Regulation.
16. Source: the official, publicly accessible websites of the theatres in which the artist performs, as well as information provided by the theatres themselves or by the artist. Before publication, all information is reviewed by an editor.
17. Purpose: presenting the theatre programme in Bulgaria – which productions are being staged, when and where, and which artists take part in them – and maintaining reference information about productions, including for past seasons.
18. Legal basis: Article 6(1)(f) of the Regulation – the legitimate interest of the Controller and of the public in receiving information about the public creative activity of artists. We publish only information related to the artist's professional activity which has already been made public by the theatre for the same purpose – presenting the production to the public.
19. Recipients: the information is publicly accessible on the Platform. In addition, it is processed by the providers referred to in Section VII.
20. Retention period: the information is retained for as long as it is linked to productions presented on the Platform, including past productions which remain accessible as part of the history of the theatre repertoire. Where an objection or a request for erasure is upheld, the information is removed within one month.
21. Your rights as an artist: you have all the rights set out in Section IX, including:
    • to request the rectification or completion of inaccurate information;
    • to request the removal or replacement of the portrait photograph or of the biography;
    • to object to the processing under Article 21 of the Regulation. Where you object, we shall cease the processing unless we demonstrate compelling legitimate grounds which override your interests, rights and freedoms.

    Requests may be addressed to [email protected].

22. Manner of providing the information. Since, as a rule, we do not have contact details for the artists, we provide this information publicly through this Policy, which is accessible from every page of the Platform.

VI. Cookies and Similar Technologies

23. The Platform uses cookies and similar technologies. Detailed information about them – type, purpose, duration and means of management – is contained in the Cookie Policy, which forms an integral part of this Policy.

VII. Recipients and Processors of Personal Data

24. We do not sell personal data and do not provide them to third parties for advertising or marketing purposes.
25. To ensure the operation of the Platform, we use the following processors:

26. The processors process the personal data in accordance with their contractual terms and data protection policies. Google processes the Google Analytics data on our behalf under the Google Ads Data Processing Terms, which we have accepted in the tool's settings.
27. Transfers outside the European Economic Area. The providers referred to in point 25 are established in the United States of America or, like Google Ireland Limited, use a sub-processor there (Google LLC), and may have access to the data from a third country. Such transfers take place on the basis of the European Commission's decision on the adequate level of protection of personal data under the EU-U.S. Data Privacy Framework – in respect of the providers certified under it, including Google LLC – or on the basis of standard contractual clauses approved by the European Commission (Article 46(2)(c) of the Regulation), which are also contained in Google's data processing terms. You may obtain information about the applicable safeguards at the contact details given in Section II.
28. We may provide personal data to public authorities where we are required to do so by law.

VIII. Summary of Retention Periods

Data are retained for no longer than is necessary for the purposes for which they are processed. On expiry of the relevant period, they are erased or irreversibly anonymised.

IX. Your Rights

29. In connection with the processing of your personal data, you have the right:
    1. of access – to obtain confirmation as to whether we process personal data concerning you and a copy of those data (Article 15 of the Regulation);
    2. to rectification – to request the rectification of inaccurate data or the completion of incomplete data (Article 16);
    3. to erasure ("right to be forgotten") – to request the erasure of your data where one of the grounds under Article 17 of the Regulation applies;
    4. to restriction of processing – in the cases under Article 18 of the Regulation;
    5. to portability – to receive the data you have provided to us in a structured, commonly used and machine-readable format, where the processing is based on consent or on a contract and is carried out by automated means (Article 20);
    6. to object – at any time, on grounds relating to your particular situation, to processing based on legitimate interest (Article 21);
    7. to withdraw your consent at any time, without affecting the lawfulness of processing before its withdrawal (Article 7(3));
    8. not to be subject to a decision based solely on automated processing, including profiling (Article 22). The Controller does not take such decisions.
30. How to exercise your rights. You may submit your request by email to [email protected] or in writing to the correspondence address set out in Section II. We will respond without undue delay and in any event no later than one month from receipt of the request. Where necessary, taking into account the complexity and number of the requests, this period may be extended by a further two months, of which we will inform you.
31. Exercising your rights is free of charge. Where a request is manifestly unfounded or excessive, we may refuse to act on it or charge a reasonable fee in accordance with Article 12(5) of the Regulation.
32. Where we have reasonable doubts concerning the identity of the person making the request, we may request additional information necessary to confirm it. We will not require a copy of an identity document.

X. Right to Lodge a Complaint

33. If you consider that the processing of your personal data infringes the Regulation or the ЗЗЛД, you have the right to lodge a complaint with the supervisory authority – the Commission for Personal Data Protection (КЗЛД):
    • address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592;
    • telephone: 02 915 3 519;
    • email: [email protected];
    • website: www.cpdp.bg.
34. The complaint may be lodged within 6 months of becoming aware of the infringement, but no later than 2 years from the date on which it was committed. You also have the right to seek protection through the courts.
35. We recommend that you contact us first – we will make every effort to resolve the matter.

XI. Data Security

36. We apply appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, including: an encrypted connection (HTTPS) for every access to the Platform, encryption of session data, access to data only by authorised persons and only to the extent necessary, traceability of actions in the administrative area, and backups stored in the European Union.

XII. Children

37. The Platform is not directed at children under 14 years of age, and we do not knowingly collect personal data of such children. Pursuant to Article 25c of the ЗЗЛД, where processing is based on consent, consent in respect of a child under 14 years of age is given by the child's parent or guardian.

XIII. Changes to the Policy

38. We may amend this Policy when the data processed, the purposes of the processing or the applicable legislation change. The current version is published on the Platform, indicating the date of the last update. In the event of material changes, we will notify you by means of a prominent notice on the Platform.
39. This Policy has been drawn up in the Bulgarian language. In the event of any discrepancy between the Bulgarian text and a translation into another language, the Bulgarian text shall prevail.