With the following Privacy Notice Chaos Software GmbH, a company organized and existing under the laws of Germany, headquarters at An der Raumfabrik 33b, 76227 Karlsruhe, Germany (“Chaos”, “We”, “the Company”) provides you with information about your personal data that can be processed when using our Digital Asset Management System. The Digital Asset Management System is a digital space where you can upload or download digital assets.

This notice is intended to help you understand why and how we may use your personal information.

What personal data about you is being processed by us? 

"Personal Data" means any information about you from which you could be identified, including information that can be protected under the applicable law.

 The personal data processed by Chaos when you use the Digital Asset Management System are:

For what purposes do we process your data?

The personal information will be used for the following purposes:

• Providing appropriate user experience in the Digital Asset Management System.
• Marketing purposes if all applicable requirements are met.

Can we share your personal information with third parties?

Chaos respects and maintains the confidentiality of your personal information and will not disclose it outside of its corporate group. Chaos is part of a corporate group of entities operating in and outside of Germany, namely, Chaos Software EOOD (Bulgaria), Chaos Czech a.s. (Czech Republic), Chaos Group Japan K.K. (Japan), Chaos Group Incorporated (South Korea), Chaos Software North American Holdings, Inc, (USA), Chaos Software, Inc. (USA), Chaos Software Holding GmbH (Germany), Chaos Software Management GmbH (Germany), Cylindo Aps (Denmark), Cylindo Aps International (Macedonia), Chaos Software Ltd. (United Kingdom) and AYXZ  design SRL (Italy). Chaos may share your personal data with other Affiliates within this Corporate Group if the applicable legal requirements are met. For avoidance of doubt “Affiliates” should mean an entity that controls, is controlled by or is under common control with company within the Corporate Group of Chaos, although not listed above.  For purposes of this defined term, “control” means ownership of more than fifty (50%) percent of the voting stock or other ownership interest in an entity.

Chaos may also share your data with service providers who help us run the Digital Asset Management System. In this instance this would be Image Relay, Inc. Image Relay will process your data on our behalf acting as data processor. Chaos has implemented all necessary technical and organizational measures to assure our service providers process personal data adhering to the best practices and assuring compliance with all legal requirements.

Is your personal data shared in countries outside the European Union and the European Economic Area?

Some of our service providers are located outside European Union (“EU”), the European Economic Area (“EEA”) and the United Kingdom(“UK”) including in the United States. Only in case one of our service providers, partners, affiliates and distributors are located or uses servers located outside of the EU or the EЕA we may transfer personal data outside of the said boundaries. However, in such cases Chaos shall ensure that adequate measures for protection of your personal data are in place and that the requirements of the GDPR are met before a cross-border transfer of personal data is executed.

How long do we keep your personal data?

Your personal data shall be stored as long as we have valid legal grounds for processing it. After this period has expired and in case there is no legal ground to continue storing your personal data, your information shall be deleted.

Your rights regarding your personal data

Subject to applicable European law, you have the following rights to your personal data processed by Chaos:

1. Access your personal data that Chaos processes and get a copy thereof.
2. In case of incompleteness or inaccuracy in the data that Chaos processes, your personal data will be corrected.
3. Request that your data be deleted when the conditions are met. Such cases are if the purpose for which the data is collected is achieved; you have withdrawn your consent when the processing is based on consent and there is no other legal basis for processing; your data is being processed unlawfully, and others.
4. In the cases specified by the law, you may require that the processing of your personal data to be limited.
5. In the cases specified by the law, you may object to the processing of your personal data.
6. Exercise your data portability rights and request that your data be provided in a structured, widely used and machine-readable format.
7. Withdraw your consent when processing your personal data is based on consent. 

You also have the right to file a complaint with the Data Protection Authority when the relevant prerequisites are in place.   

How to contact us?

You can contact us at the following address: 145 Tsarigradsko shose Blvd., Sofia Office Center, 12th floor, 1784 Sofia, Bulgaria: dpo@chaos.com.