Privacy Policy
Last updated: May 2026.
Introduction
This Privacy Policy describes how Association „Bansko Bike Fest“ (hereinafter referred to as the „Association“, „we“ or the „Organiser“) processes your personal data when using the website banskobikefest.com and upon registration and participation in the festival's events Bansko Bike Fest.
The policy has been drawn up in accordance with Regulation (EU) 2016/679 (GDPR), the Personal Data Protection Act, and applicable Bulgarian legislation.
2. Personal data administrator
- Name: Association „Bansko Bike Fest“
- Company registration number 208810257
- Registered office and administrative address: Bulgaria, Bansko (2770), 2 Stragite Street
- Representing: Martin Angelin
- Email: office@banskobikefest.com
- Phone: +359 886 115 858
- Website banskobikefest.com
3. What data do we process
Depending on your interaction with us, we process the following categories of personal data:
3.1 Registration and participation in events
- Identification details: first name, surname, date of birth/age (when required for age group categorisation), gender.
- Contact details: email, telephone, town/city.
- Participation details: selected event(s), race number, category, bike type, possibly times/ranking for Bike Rally.
- Emergency contact person details (name and phone number), when required for a specific event.
3.2 Data of Minor Participants
For children's events and participants under 18 years of age: child's name and age, parent/guardian's name and contact details, who gives consent for participation (see section 12).
3.3 Purchase Data
Ticket type, amount, payment method, transaction date and time, order number. We do not store full bank card data — payments are processed directly by a licensed payment operator.
3.4 Health information (special category, Art. 9 GDPR)
If you voluntarily provide information about health conditions, allergies or medication on an entry form or during an incident at an event, it will be processed solely for the purposes of providing assistance and ensuring safety, based on your explicit consent (or vital interests in an emergency). This data is stored for a limited time and access to it is strictly restricted.
3.5 Technical Data
IP address, browser type, operating system, device information, language preferences, pages visited on the site — for security, statistics and service improvement.
3.6 Communication
Content of email enquiries, contact forms, social media correspondence.
3.7 Photo and video materials
Photos and videos from events where you might be recognisable. See section 13.
4. Mandatory and voluntary provision
Providing basic data (names, email, chosen event) is necessary for the conclusion and execution of the participation agreement. Without it, we cannot process your registration and issue you a ticket.
Other details are voluntary (e.g. emergency contact telephone number, health information), but we recommend them for your safety.
When minors are involved, providing the parent/guardian's details and their express consent is mandatory.
5. Objectives and legal grounds
| Purpose | Legal basis (GDPR) |
|---|---|
| Registration, ticket issuance, check-in, and event admission | Performance of contract (Art. 6, para. 1, point „b“) |
| Ranking, timekeeping, results announcement for a Cycling Rally | Performance of contract (Art. 6, para. 1, point „b“) |
| Accounting, invoicing, tax and regulatory compliance | Statutory obligation (Art. 6, para. 1, lit. „c“) |
| Participant safety, first aid, incident response | Vital interest (Art. 6(1)(d)) / consent for health data (Art. 9(2)(a)) |
| Improving services, website security, preventing abuse | Legitimate interest (Article 6(1)(e)) |
| Marketing and newsletter for future editions | Explicit consent (Article 6, paragraph 1, letter (a)) with the option to withdraw at any time |
| Photo and video shooting for reporting, media and advertising purposes | Legitimate interest and/or consent — see section 13 |
| Defence against legal claims | Legitimate interest (Article 6(1)(e)) |
6. Cookies and similar technologies
The site banskobikefest.com uses cookies and similar technologies (including pixels and tags). It is possible that some of these are placed by third parties:
- Required — for the basic functioning of the website and shopping cart (session, language, spam protection). Basis: legitimate interest/performance of service.
- Analytical — for example Google Analytics (via Google Tag Manager), to understand traffic and improve the website. Basis: consent.
- Marketing / social — for example Meta (Facebook) Pixel, for advertising and measuring their effectiveness. Basis: consent.
You can manage your consent via the cookie banner and withdraw it at any time. You can also control cookies through your browser settings — but please be aware that if you completely refuse them, some site functions (such as the shopping cart) may not work fully.
Details are available in Cookie Policy.
7. Recipients and processors
We do not sell your personal data.
Your data may be shared with the following categories of recipients, processors or partners, always under contract and with appropriate safeguards:
- Payment operators — for processing online payments.
- Hosting and technical support — on our website and systems.
- Email/communication services — for sending confirmations and newsletters.
- Analytical and marketing platforms — Google (Analytics, Tag Manager), Meta (Facebook/Instagram), with your consent.
- Time measurement contractors (chip timing) at race events, if used — process ranking data.
- Insurance broker — if general insurance is provided for a specific event.
- Partners and sponsors At the Festival, they can receive aggregated, non-personalised statistics; personalised data is shared only with your consent or under the conditions in Section 13 (photo/video).
- Competent state and municipal authorities — when the law requires it (police, health authorities, court, DPC, etc.).
- Medical services — in case of an incident or need for emergency assistance.
Some providers (e.g. cloud, analytics, or marketing services) may process data outside the European Economic Area. In these cases, we apply appropriate GDPR safeguards (EU Standard Contractual Clauses or adequacy decisions).
8. Data Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or misuse: encrypted connections (HTTPS), access control, a limited number of processors, password policies, updated systems. Health data is processed with additional caution and restricted access.
9. Shelf life
We store personal data only for the period necessary for the purposes for which it was collected, or as required by mandatory legal provisions:
- Registration details for participation: up to 12 months after the end of the relevant edition of the Festival, unless you intend to participate in a subsequent edition.
- Accounting documents10 years according to the Accounting Act.
- Velorally Results (rankings, times): can be stored and published without restriction as part of the Festival's history, in the usual scope – name, category, time/place.
- Marketing profile (for newsletter): until you withdraw your consent.
- Enquiries and correspondence: up to 24 months after the last contact.
- Health information, provided voluntarily: deleted after the relevant event, unless an incident has occurred which requires longer retention for the protection of legal claims.
- Photo and video materialsin accordance with section 13.
After expiry, data is deleted or anonymised.
10. Your Rights
Under GDPR, you have the following rights:
- Access — to receive information about what data of yours we process.
- Correction — to request a correction of inaccurate or incomplete data.
- Delete („right to be forgotten“) — under certain conditions.
- Restriction of processing under certain conditions.
- Portability — to receive your data in a structured, machine-readable format.
- Objection — to processing on the grounds of legitimate interest or for direct marketing purposes.
- Withdrawal of consent — at any time, without affecting the lawfulness of processing before withdrawal.
To exercise these rights, please write to us at office@banskobikefest.com. We will respond within 1 month.
You have the right to lodge a complaint with the supervisory authority:
Commission for Personal Data Protection (CPDP)
- Address: Sofia 1592, 2 Prof. Tsvetan Lazarov Boulevard
- Website www.cpdp.bg
- Email: kzld@cpdp.bg
11. Data Protection Officer (DPO)
In accordance with applicable legislation, the Association is not obliged to appoint a Data Protection Officer. Questions relating to the processing of personal data and the exercise of your rights can be addressed to office@banskobikefest.com.
12. Children and minors
The association processes personal data of children and minors solely in connection with their participation in children's events and/or other events that permit the participation of persons under 18 years of age, according to the rules of the specific event.
- Registration of a person under 18 years of age must be carried out by a parent or guardian, who will provide their contact details and explicit consent.
- We do not knowingly collect data from children under 14 without parental/guardian consent.
- The parent/guardian has all rights under Section 10 on behalf of their child.
- Photographs and videos of children are processed with particular caution (see Section 13).
13. Photo and video materials from events
During the Festival events, photo and video recording will be carried out by the Association and/or persons authorised by it (photographers, videographers, media partners).
Purposes of processing:
- Reporting and archival purposes of the Festival;
- Publishing in the Festival's gallery and social networks;
- communication with the media, partners, and sponsors;
- Advertising for upcoming issues.
Legal grounds the Association's legitimate interest in documenting and publicising events; consent, when it concerns individuals who are recognisable as the main subject of a photo/video; consent of a parent/guardian for children.
Right of objection If you do not wish to be photographed or published in a recognisable way, please inform the Festival reception staff in advance (Vazrazhdane Square, Bansko) or write to us at office@banskobikefest.com. With material already published, we will remove it within a reasonable timeframe.
Shelf life: The materials can be stored indefinitely in the Festival's archive, unless you object.
14. Automated decisions and profiling
We do not carry out automated decision-making with legal consequences for you, nor do we apply profiling within the meaning of Article 22 of the GDPR in connection with registrations and online orders.
15. Related Documents
16. Policy changes
This Privacy Policy may be updated periodically. The current version is always available at banskobikefest.com. In the event of substantial changes, we will inform you accordingly (e.g. via a banner on the website or by email).
17. Contact
For questions relating to this Privacy Policy or to exercise your rights:
- Association „Bansko Bike Fest“, Company ID 208810257
- Address: Bansko (2770), 2 St. G. St.
- Email: office@banskobikefest.com
- Phone: +359 886 115 858
- Website banskobikefest.com
