Privacy Policy

Mandatory information on data subjects' rights regarding personal data protection

 

Information about the company that processes your data:

 

Name: Maria Commerce EOOD

EIK/BULSTAT: 131111680

Registered office and management address: BULGARIA, Sofia, Nadezhda district, NADEZHDA housing estate, bl. 172, shop 13

Correspondence address: BULGARIA, Sofia, Nadezhda district, NADEZHDA housing estate, bl. 172, shop 13

Phone: 0876 396 463

E-mail: [email protected]

Website: https://groom.bg

 

Information about the competent supervisory authority for personal data protection

 

Name: Commission for Personal Data Protection

Registered office and management address: Sofia 1592, 2 "Prof. Tsvetan Lazarov" Blvd.

Correspondence address: Sofia 1592, 2 "Prof. Tsvetan Lazarov" Blvd.

Phone: 02 915 3 518

Website: www.cpdp.bg

 

Maria Commerce EOOD (hereinafter referred to as the “Controller” or the “Company”) carries out its activities in accordance with the Personal Data Protection Act and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. This information is intended to inform you of all aspects of the Company's processing of your personal data and the rights you have in connection with this processing.



Grounds for collecting, processing and storing your personal data

 

Art. 1.The Controller collects and processes your personal data in connection with the use of the online store https://groom.bg and the conclusion of contracts with the Company, on the basis of Art. 6(1) of Regulation (EU) 2016/679 (GDPR), and more specifically on the following grounds:

  • Explicit consent given by you as a customer;
  • Performance of the Controller's obligations under a contract with you;
  • Compliance with a legal obligation applicable to the Controller;
  • For the purposes of the legitimate interests of the Controller or a third party;

 

Purposes and principles for collecting, processing and storing your personal data

 

Art. 2. (1)We collect and process the personal data you provide to us in connection with the use of the online store and the conclusion of a contract with the Company, including for the following purposes:

  • creating an account and providing full functionality when using the online store;
  • concluding and performing a distance contract;
  • identifying a party to the contract;
  • accounting purposes;
  • statistical purposes;
  • protecting information security;
  • ensuring performance of the contract for the provision of the relevant service.
  • sending a newsletter, where you have expressed a wish to receive one;

(2) We observe the following principles when processing your personal data:

  • lawfulness, fairness and transparency;
  • purpose limitation;
  • relevance to the purposes of processing and minimisation of the data collected;
  • accuracy and currency of the data;
  • storage limitation in order to achieve the purposes;
  • integrity and confidentiality of processing, and ensuring an appropriate level of security for personal data.

(3) When processing and storing personal data, the Controller may process and store personal data in order to protect the following legitimate interests:

  • fulfilling its obligations to the National Revenue Agency, the Ministry of Interior and other state and municipal authorities.

 

What types of personal data our company collects, processes and stores

 

Art. 3. (1) The Company carries out the following operations with the personal data you provide, for the following purposes:

  • Registering a user in the online store and performing a distance sales contract – the purpose of this operation is to create an account for using the online store to purchase goods and to provide contact details for delivering the purchased goods. Registering and creating an account to use the online store is not a mandatory step in providing the service, and the service is available to a large extent even without creating an account.
    Conclusion of the impact assessment: Based on the impact assessment carried out, the operation “Registering a user in the online store and performing a distance sales contract” is permissible and provides sufficient guarantees for protecting the rights and legitimate interests of data subjects in accordance with the requirements of the GDPR.
  • Concluding and performing a commercial transaction with a customer or partner – the purpose of this operation is to conclude and perform a contract with a business partner or customer and to administer it. Given the limited scope of the personal data collected and the fact that some of it is collected from publicly available sources, carrying out an impact assessment for this operation is not necessary.
  • Sending a newsletter – the purpose of this operation is to administer the process of sending newsletters to customers who have indicated that they wish to receive them. Given the limited scope of the personal data collected, carrying out an impact assessment for this operation is not necessary.
  • Exercising the right of withdrawal or making a complaint – the purpose of this operation is to administer the process by which the customer exercises the right of withdrawal or makes a complaint. Given the limited scope of the personal data collected, carrying out an impact assessment for this operation is not necessary.

(2) The Controller processes the following categories of personal data and information for the following purposes and on the following grounds:

  • Your identifying details (email address, name, etc.)
    • Purpose for which the data is collected: 1) contacting the user and sending information to them, 2) registering a user in the online store, and 3) sending a newsletter.
    • Grounds for processing your personal data - By accepting the general terms and conditions and registering in the online store, or placing an order without registering, or concluding a written contract, a contractual relationship is created between the Controller and you, on the basis of which we process your personal data – Art. 6(1)(b) GDPR. Your data for sending a newsletter is processed on the basis of your explicit consent - Art. 6(1)(a) GDPR.
  • Data for making a delivery(names, phone number, address, etc.)
    • Purpose for which the data is collected: Performance of the Controller's obligations under the sales and delivery contract for the purchased goods.
    • Grounds for processing your personal data - By accepting the general terms and conditions and registering in the online store, or placing an order without registering, or concluding a written contract, a contractual relationship is created between the Controller and you, on the basis of which we process your personal data – Art. 6(1)(b) GDPR.
  • Additional data provided by you – If you wish to supplement your account, you can add your first name, last name and phone number to it.
    • Purpose for which the data is collected: Supplementing the user's information in their user account.
    • Grounds for processing the data: You have given explicit consent for the processing of your personal data for one or more specific purposes - Art. 6(1)(a) GDPR, at the time of registering in the online store. Providing this data is not mandatory for registering in the online store.

(3)The Controller does not collect or process personal data relating to the following:

  • revealing racial or ethnic origin;
  • revealing political, religious or philosophical beliefs, or trade union membership;
  • genetic and biometric data, data concerning health, or data concerning sex life or sexual orientation.

(4) The personal data is collected by the Controller from the persons to whom it relates.

(5) The Company does not carry out automated decision-making using data.

Art. 4. (1) The Company carries out the following operations with the personal data you provide as legal representatives or authorised agents of legal entities that are business partners, for the following purposes:

  • Concluding and performing a commercial transaction: For concluding and performing a commercial transaction with a company, we process only the full name of the legal representative or the person authorised by the company. Conclusion of the impact assessment: Given the small number of individuals whose data is processed and the limited amount of personal data collected, carrying out an impact assessment is not necessary for this operation.

(2) The personal data is collected by the Controller from the persons to whom it relates and from the Commercial Register maintained by the Registry Agency.

(3) The Company does not carry out automated decision-making using data.

Art. 5. The Controller may use so-called “cookies” to provide full website functionality, improve the user experience, for statistical purposes, easier access, etc., to which you consent by using our website. You can control and/or delete “cookies” at any time through your browser settings. “Cookies” do not constitute personal data and are not used to identify visitors and users of the online store.

 

Retention period for your personal data

 

Art. 6. (1) The Controller stores your personal data for a period no longer than the existence of your account in the online store. After your account is deleted, the Controller takes the necessary care to delete and destroy all your data without undue delay, or to anonymise it (i.e. to convert it into a form that does not reveal your identity).

(2) The Controller processes the personal data you have provided when placing an order without registering in the online store until the order is completed, unless you have given your explicit consent when placing the order for your data to be processed for the purposes of improving the service, providing recommended content for you, individual terms, promotions, and for statistical purposes.

(3) The Controller stores your personal data provided in connection with online orders for a period of 5 years, in order to protect the Controller's legal interests in any judicial or administrative disputes with users of the online store.

(4) The Controller will notify you if the data retention period needs to be extended in order to comply with a statutory obligation, in view of the Controller's legitimate interests, or otherwise.

(5) The Controller stores personal data that it is required to keep under applicable law for the relevant statutory period, which may exceed the period your account exists in the online store or the completion of the order.

Art. 7. The Controller stores the personal data of the legal representatives of its business partners for the duration of the contract's performance, in order to comply with the Controller's legitimate interests and statutory obligations; this period may exceed the term of the concluded contract.

 

Transfer of your personal data for processing

 

Art. 8. (1) At its own discretion, the Controller may transfer some or all of your personal data to data processors in order to fulfil the processing purposes you have agreed to, in compliance with the requirements of Regulation (EU) 2016/679 (GDPR).

(2) The Controller will notify you if it intends to transfer some or all of your personal data to third countries or international organisations.

 

Your rights regarding the collection, processing and storage of your personal data

 

Withdrawal of consent to the processing of your personal data

 

Art. 9. (1) If you do not wish the personal data you have provided to be processed for marketing purposes or for receiving a newsletter, you may withdraw your consent to processing at any time by completing the consent withdrawal form in Appendix No. 1, or by a free-text request, and sending it to us by email.

(2) Once we receive your request, we will send an email to the address you provided for receiving newsletters and promotional messages, with detailed instructions for verifying you as a newsletter recipient and as the data subject for whom withdrawal of consent has been requested.

(3) Withdrawal of consent does not affect the lawfulness of the processing of personal data carried out by the Controller up to that point.

 

Right of access

 

Art. 10. (1) You have the right to request and receive confirmation from the Controller as to whether personal data relating to you is being processed, by sending a free-text request by email.

(2) You have the right to access the data relating to you, as well as the information concerning the collection, processing and storage of your personal data.

(3) Once we receive your request, we will send an email to the address you used to register or place orders in the online store, with detailed instructions for verifying you as the data subject for whom access has been requested.

(4) Once verification under para. 3 has been carried out, the Controller will provide you, upon request, with a copy of the personal data relating to you that is being processed, in electronic or another suitable form.

(5) Access to the data is provided free of charge, but the Controller reserves the right to charge an administrative fee in the event of repeated or excessive requests.

 

Right to rectification or completion

 

Art. 11. (1) You may at any time correct or complete inaccurate or incomplete personal data relating to you via the “Edit profile” option.

(2) You may correct or complete inaccurate or incomplete personal data relating to you directly through your account on the website, or by submitting a request to the Controller by email, using the form in Appendix No. 4 or a free-text request.

 

Right to erasure (“right to be forgotten”)

 

Art. 12. (1) You have the right to request that the Controller erase some or all of the personal data relating to you, and the Controller is obliged to erase it without undue delay where one of the grounds listed below applies:

  • the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
  • you withdraw the consent on which the processing of the data is based, and there is no other legal ground for the processing;
  • you object to the processing of personal data relating to you, including for direct marketing purposes, and there are no overriding legitimate grounds for the processing;
  • the personal data has been processed unlawfully;
  • the personal data must be erased in order to comply with a legal obligation under EU law or the law of a Member State to which the Controller is subject;
  • the personal data has been collected in connection with the offer of information society services.

(2) The Controller is not obliged to erase the personal data if it is storing and processing it:

  • in order to exercise the right of freedom of expression and information;
  • in order to comply with a legal obligation requiring processing under EU law or the law of the Member State to which the Controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller;
  • for reasons of public interest in the area of public health;
  • for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes;
  • for the establishment, exercise or defence of legal claims.

(3) In order to exercise your right to be forgotten, you must send by email a request for the erasure of your personal data processed by the Controller, by completing the form in Appendix No. 2 or by a free-text request, after which the Controller will send an email to the address you used to register or place orders in the online store, with detailed instructions for verifying you as a user of the store and the data subject for whom erasure has been requested.

(4) Once we have verified the identity of the person making the request and the person to whom the data relates, in accordance with the instructions sent to you, we will erase all the data we process about you, in accordance with para. 3.

(5) If you have an order that is being processed, the earliest point at which you can request to be “forgotten” is upon successful completion of the order.

 

Right to restriction of processing

 

Art. 13. You have the right to request that the Controller restrict the processing of data relating to you, by sending us a free-text request by email, where:

  • you contest the accuracy of the personal data, for a period enabling the Controller to verify the accuracy of the personal data;
  • the processing is unlawful, but you do not wish the personal data to be erased and instead request that its use be restricted;
  • the Controller no longer needs the personal data for the purposes of processing, but you require it for the establishment, exercise or defence of legal claims;
  • you have objected to the processing pending verification as to whether the Controller's legitimate grounds override your interests.

(2) Once we receive your request, we will send an email to the address you used to register or place orders in the online store, with detailed instructions for verifying you as a user of the store and the data subject for whom restriction of processing has been requested.

(3) Once verification under para. 2 has been carried out, the Company will stop processing your data, but will not remove any posts you have made in the online store, if any.

 

Right to data portability

 

Art. 14. (1) If you have given consent to the processing of your personal data, or the processing is necessary for the performance of the contract with the Controller, or if your data is processed by automated means, you may:

  • request that the Controller provide you with your personal data in a readable format so that you can transfer it to another controller;
  • request that the Controller transfer your personal data directly to a controller specified by you, where this is technically feasible.

(2) You may exercise the right to data portability by sending us by email a completed form under Appendix No. 3 or a free-text request, after which the Controller will send an email to the address you used to register or place orders in the online store, with detailed instructions for verifying you as a user of the store and the data subject for whom a portability request has been made.

(3) Once verification under para. 2 has been carried out, the Company will send the data it processes about you to the email address you have indicated, in XML format.

 

Right to receive information

 

Art. 15. You may request that the Controller inform you of all recipients to whom the personal data for which rectification, erasure or restriction of processing has been requested has been disclosed. The Controller may refuse to provide this information if this would be impossible or would require disproportionate effort.

 

Right to object

 

Art. 16. You may object at any time to the Controller's processing of personal data relating to you, including where it is processed for the purposes of profiling or direct marketing.

 

Your rights in the event of a breach of the security of your personal data

 

Art. 17. (1) If the Controller identifies a breach of the security of your personal data that is likely to result in a high risk to your rights and freedoms, it will notify you of the breach without undue delay, together with the measures taken or to be taken.

(2) The Controller is not obliged to notify you if:

  • it has implemented appropriate technical and organisational protection measures with regard to the data affected by the security breach;
  • it has subsequently taken measures ensuring that the breach is unlikely to result in a high risk to your rights;
  • notification would require disproportionate effort.

 

Persons to whom your personal data is disclosed

 

Art. 18. (1) For the purposes of processing your personal data and providing the service with its full functionality, and having regard to your interests, the Controller may disclose the data to the following persons, who are data processors:

 

Data processor         Purpose of processing personal data

 

............................................... .....................................................................

............................................... .....................................................................

............................................... .....................................................................

 

(2) Data processors comply with all lawfulness and security requirements when processing and storing your personal data.

Art. 19. The Controller does not transfer your data to third countries.

Art. 20. In the event of a violation of your rights under the above or under applicable personal data protection legislation, you have the right to lodge a complaint with the Commission for Personal Data Protection, as follows:

 

Name: Commission for Personal Data Protection.

Registered office and management address: Sofia 1592, 2 "Prof. Tsvetan Lazarov" Blvd.

Correspondence address: Sofia 1592, 2 "Prof. Tsvetan Lazarov" Blvd.

Phone: 02 915 3 518

Website: www.cpdp.bg

 

Art. 21. You can exercise all your rights regarding the protection of your personal data using the forms attached to this information. Of course, these forms are not mandatory, and you may submit your requests in any form that contains a statement to that effect and identifies you as the data subject.

Art. 22. Where the consent concerns a transfer, the Controller describes the possible risks of transferring data to third countries in the absence of an adequacy decision and appropriate safeguards.




Appendix No. 1

 

Form for withdrawing consent to processing

 

Your name*: .........................

Your email address, which you used in the online store*: .........................

Contact details (e-mail)*: .........................

 

To

Name: Maria Commerce EOOD

EIK/BULSTAT: 131111680

Registered office and management address: BULGARIA, Sofia, Nadezhda district, NADEZHDA housing estate, bl. 172, shop 13

Correspondence address: BULGARIA, Sofia, Nadezhda district, NADEZHDA housing estate, bl. 172, shop 13

Phone: 0876 396 463

E-mail: [email protected]

Website: https://groom.bg

 

I hereby withdraw my consent to the processing of the personal data I have provided for the purposes of receiving a newsletter, promotional messages or other marketing materials, being aware of the terms for withdrawing consent in accordance with the Mandatory Information on Data Subjects' Rights of the online store.

In the event of a violation of your rights under the above or under applicable personal data protection legislation, you have the right to lodge a complaint with the Commission for Personal Data Protection, as follows:

 

Name: Commission for Personal Data Protection.

Registered office and management address: Sofia 1592, 2 "Prof. Tsvetan Lazarov" Blvd.

Correspondence address: Sofia 1592, 2 "Prof. Tsvetan Lazarov" Blvd.

Phone: 02 915 3 518

Website: www.cpdp.bg




Appendix No. 2

 

Request to be “forgotten” - for erasure of the personal data relating to me

 

Your name*: .........................

Your email address, with which you registered or which you used for orders in the online store*: .........................

Contact details (e-mail)*: .........................

 

To

Name: Maria Commerce EOOD

EIK/BULSTAT: 131111680

Registered office and management address: BULGARIA, Sofia, Nadezhda district, NADEZHDA housing estate, bl. 172, shop 13

Correspondence address: BULGARIA, Sofia, Nadezhda district, NADEZHDA housing estate, bl. 172, shop 13

Phone: 0876 396 463

E-mail: [email protected]

Website: https://groom.bg

 

Please erase from your databases all personal data that you collect, process and store, provided by me or by third parties connected with me, in accordance with the identification provided.

I declare that I am aware that some or all of my personal data may continue to be processed and stored by the Controller for the purpose of fulfilling its statutory obligations.

In the event of a violation of your rights under the above or under applicable personal data protection legislation, you have the right to lodge a complaint with the Commission for Personal Data Protection, as follows:

 

Name: Commission for Personal Data Protection.

Registered office and management address: Sofia 1592, 2 "Prof. Tsvetan Lazarov" Blvd.

Correspondence address: Sofia 1592, 2 "Prof. Tsvetan Lazarov" Blvd.

Phone: 02 915 3 518

Website: www.cpdp.bg

Appendix No. 3

 

Request for portability of personal data

 

Your name*: .........................

Your email address, with which you registered or which you used for orders in the online store*: .........................

Contact details (e-mail)*: .........................

 

To

Name: Maria Commerce EOOD

EIK/BULSTAT: 131111680

Registered office and management address: BULGARIA, Sofia, Nadezhda district, NADEZHDA housing estate, bl. 172, shop 13

Correspondence address: BULGARIA, Sofia, Nadezhda district, NADEZHDA housing estate, bl. 172, shop 13

Phone: 0876 396 463

E-mail: [email protected]

Website: https://groom.bg 

Please send all personal data relating to me that is collected, processed and stored in your databases, in XML format, to:

e-mail: [email protected]

Controller receiving the data: Maria Madzharova

 

Name: Maria Commerce EOOD

Identification number (EIK, BULSTAT, CPDP reg. no.): 131111680

E-mail: [email protected]

 

In the event of a violation of your rights under the above or under applicable personal data protection legislation, you have the right to lodge a complaint with the Commission for Personal Data Protection, as follows:

 

Name: Commission for Personal Data Protection.

Registered office and management address: Sofia 1592, 2 "Prof. Tsvetan Lazarov" Blvd.

Correspondence address: Sofia 1592, 2 "Prof. Tsvetan Lazarov" Blvd.

Phone: 02 915 3 518

Website: www.cpdp.bg




Appendix No. 4

 

Request for correction of data

 

Your name*: .........................

Your email address, with which you registered or which you used for orders in the online store*: .........................

Contact details (e-mail)*: .........................

 

To

Name: Maria Commerce EOOD

EIK/BULSTAT: 131111680

Registered office and management address: BULGARIA, Sofia, Nadezhda district, NADEZHDA housing estate, bl. 172, shop 13

Correspondence address: BULGARIA, Sofia, Nadezhda district, NADEZHDA housing estate, bl. 172, shop 13

Phone: 0876 396 463

E-mail: [email protected]

Website: https://groom.bg

 

Please correct the following personal data, which you collect, process and store, provided by me or by third parties connected with me, as follows:

Data to be corrected:

..................................................

Please correct it as follows:

..................................................

In the event of a violation of your rights under the above or under applicable personal data protection legislation, you have the right to lodge a complaint with the Commission for Personal Data Protection, as follows:

 

Name: Commission for Personal Data Protection.

Registered office and management address: Sofia 1592, 2 "Prof. Tsvetan Lazarov" Blvd.

Correspondence address: Sofia 1592, 2 "Prof. Tsvetan Lazarov" Blvd.

Phone: 02 915 3 518

Website: www.cpdp.bg