+359 885 767 770 Book now

Information

Privacy policy

Information about the Data Controller:

ANTOANET OOD is a company registered under the Commerce Act of the Republic of Bulgaria, UIC: 831407913, with registered office and management address at 2 Veslets St, floor 5, apt. 16, Oborishte district, Sofia, email: tsvetybita@gmail.com, phone: 0896 60 53 06.

The company is represented by its manager Antoaneta Bita.

Legal grounds and purposes for which we use your personal data

We process your personal data on the following grounds:

  • The contract concluded between us, in order to fulfil our obligations under it;
  • Your explicit consent – the purpose is stated in each specific case;
  • Where required by law.

In the following paragraphs you will find detailed information about the processing of your personal data depending on the legal ground on which we process it.

FOR THE PERFORMANCE OF A CONTRACT OR IN THE CONTEXT OF PRE-CONTRACTUAL RELATIONS

We process your personal data in order to fulfil our contractual and pre-contractual obligations and to exercise our rights under the contracts concluded with you.

Purposes of processing:

  • establishing your identity;
  • managing and fulfilling your request and performing a concluded contract;
  • preparing an offer to conclude a contract;
  • preparing and sending an invoice for the services you use;
  • providing you with the complete service you need and collecting the amounts due for the services used;
  • keeping correspondence related to orders, requests, problem reports, etc.;
  • notifying you of everything related to the services you use;
  • detecting and/or preventing unlawful actions or actions contrary to our terms for the respective services.

Data we process on this ground:

On the basis of the contract concluded between us, we process information about the type and content of the contractual relationship, as well as any other information related to it, including:

  • personal contact details – phone number;
  • identification data – first and last name, delivery address, email;
  • emails, letters, information about your requests to resolve problems, complaints and requests;
  • other feedback we receive from you;
  • information about your actions on our website.

Processing this personal data is necessary for us to conclude and perform the contract with you. Without this data we would not be able to fulfil our obligations under the contract.

Disclosure of personal data to third parties

We disclose your personal data to third parties, our main purpose being to offer you a high-quality, fast and complete service. We do not disclose your personal data to third parties before making sure that all technical and organisational measures to protect the data have been taken, and we strive to exercise strict control over this. In such cases we remain responsible for the confidentiality and security of your data.

We disclose personal data to the following categories of recipients (data controllers):

  • postal operators and courier companies;
  • persons who, on our instructions, maintain equipment, software and hardware used for processing personal data and necessary for the company's activity;
  • persons providing consultancy services in various fields.

When we delete the data collected on this ground

We delete data collected on this ground 5 years after the end of the contractual relationship, whether due to the expiry of the contract, its termination or any other reason.

TO COMPLY WITH LEGAL OBLIGATIONS

The law may require us to process your personal data. In such cases we are obliged to carry out the processing, for example:

  • obligations under the Measures Against Money Laundering Act;
  • obligations related to distance selling and off-premises sales under the Consumer Protection Act;
  • providing information to the Consumer Protection Commission or third parties as provided for in the Consumer Protection Act;
  • providing information to the Commission for Personal Data Protection in connection with obligations under data protection legislation;
  • obligations under the Accountancy Act, the Tax and Social Insurance Procedure Code and other related legislation, in connection with keeping lawful accounts;
  • providing information to the court and third parties in court proceedings, in accordance with the applicable legislation;
  • age verification for online purchases.

When we delete the personal data collected on this ground

We delete data collected under a legal obligation once the obligation to collect and store it has been fulfilled or has ceased. For example:

  • under the Accountancy Act, for storing and processing accounting data (11 years);
  • obligations to provide information to the court, competent state authorities and other grounds under applicable legislation (5 years).

Disclosure of data to third parties

Where the law places an obligation on us, we may disclose your personal data to the competent state authority, natural person or legal entity.

WITH YOUR CONSENT

We process your personal data on this ground only with your explicit, unambiguous and voluntary consent. There will be no adverse consequences for you if you refuse the processing of your personal data.

Consent is a separate ground for processing your personal data; the purpose of the processing is stated in the consent itself and does not overlap with the purposes listed in this policy. If you give us the relevant consent, until it is withdrawn or until all contractual relations with you end, we prepare offers for products/services suited to you by carrying out detailed analyses of your basic personal data.

Detailed analysis is a method that allows large volumes of data to be processed using statistical models, algorithms and other techniques involving personal data, as well as pseudonymisation and anonymisation, in order to extract information about trends and various statistical indicators.

Data we process on this ground:

On this ground we process only the data for which you have given us your explicit consent. The specific data is determined in each individual case. It usually includes:

  • Email
  • Phone
  • Address
  • Name

Disclosure of data to third parties

On this ground we may share your data with marketing agencies, Facebook, Google or similar.

Withdrawing consent

Consents given may be withdrawn at any time. Withdrawing consent does not affect the performance of contractual obligations. If you withdraw your consent to the processing of personal data for some or all of the purposes described above, we will not use your personal data and information for those purposes. Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal.

To withdraw your consent, simply use our website or our contact details.

When we delete the data collected on this ground

We delete data collected on this ground at your request or 6 months after it was first collected.

PROCESSING OF ANONYMISED DATA

We process your data for statistical purposes, meaning analyses in which the results are only aggregated and the data is therefore anonymous. It is impossible to identify a specific person from this information.

Your data may also be anonymised. Anonymisation is an alternative to deleting data. With anonymisation, all personally identifiable elements (elements that allow you to be identified) are irreversibly removed. There is no legal obligation to delete anonymised data, as it is not personal data.

Why and how we use automated algorithms

To process your personal data we use partially automated algorithms and methods in order to continuously improve our products and services and adapt them to your needs as well as possible. This process is called profiling.

How we protect your personal data

To ensure adequate protection of the data of the company and its clients, we apply all the necessary organisational and technical measures provided for in the Personal Data Protection Act.

The company has established rules to prevent misuse and security breaches.

For maximum security when processing, transferring and storing your data, we may use additional protection mechanisms such as encryption, pseudonymisation and others.

Personal data received from third parties

We may receive personal data about you from other users.

Users' rights

Every User of the website enjoys all data protection rights under Bulgarian legislation and European Union law.

Users can exercise their rights through the contact form or by sending a message to our email.

Every User has the right to:

  • Information (regarding the processing of their personal data by the controller);
  • Access to their own personal data;
  • Rectification (if the data is inaccurate);
  • Erasure of personal data (the “right to be forgotten”);
  • Restriction of processing by the controller or processor;
  • Portability of personal data between controllers;
  • Object to the processing of their personal data;
  • Not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them;
  • Judicial or administrative protection if the data subject's rights have been violated.

The User may request erasure if one of the following conditions applies:

  • The personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
  • The User withdraws the consent on which the processing is based and there is no other legal ground for the processing;
  • The User objects to the processing and there are no overriding legitimate grounds for the processing;
  • The personal data has been processed unlawfully;
  • The personal data must be erased to comply with a legal obligation under Union or Member State law to which the controller is subject;
  • The personal data has been collected in relation to the offer of information society services to children and consent was given by the holder of parental responsibility.

The User has the right to restrict the processing of their personal data by the controller when:

  • They contest the accuracy of the personal data. In this case the processing is restricted for a period that allows the controller to verify the accuracy of the data;
  • The processing is unlawful, but the User does not want the personal data erased and requests restriction of its use instead;
  • The controller no longer needs the personal data for the purposes of the processing, but the User requires it for the establishment, exercise or defence of legal claims;
  • They have objected to the processing, pending verification of whether the controller's legitimate grounds override those of the User.

Right to data portability.

The data subject has the right to receive the personal data concerning them, which they have provided to a controller, in a structured, commonly used and machine-readable format, and the right to transmit that data to another controller without hindrance, where the processing is based on consent or a contract and is carried out by automated means. When exercising this right, the data subject has the right to have the personal data transmitted directly from one controller to another, where technically feasible.

Right to object.

Users have the right to object to the controller about the processing of their personal data. The controller must stop the processing unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims. Where processing for direct marketing purposes is objected to, it must stop immediately.

Complaint to the supervisory authority

Every User has the right to lodge a complaint about unlawful processing of their personal data with the Commission for Personal Data Protection or the competent court.

Record keeping

We keep a record of the processing activities for which we are responsible. This record contains all the information listed below:

  • the name and contact details of the controller;
  • the purposes of the processing;
  • a description of the categories of data subjects and the categories of personal data;
  • the categories of recipients to whom the personal data have been or will be disclosed,
  • including recipients in third countries or international organisations;
  • where possible, the envisaged time limits for erasure of the different categories of data;
  • where possible, a general description of the technical and organisational security measures.

This Privacy Policy was adopted and approved on 23.05.2024 by ANTOANET OOD.