Privacy policy

Under the General Data Protection Regulation, the controller is obliged to inform data subjects in a clear manner. This policy fulfils that duty to inform.

1. Controller

Company name

Contact details:
Address
Postcode and town

Contact details in matters concerning the register

Company / person name
address
postcode and town
telephone number
email

Where applicable, the contact details of the data protection officer:

Data protection officer

Company / person name
address
postcode and town
telephone number
email

2. Data subjects

Who is in the register, e.g. customers, potential customers, etc.

3. Purpose of processing personal data

Basis for keeping the register:

• e.g. Personal data is processed on the basis of the data subject's customer relationship
• e.g. Personal data is processed on the basis of consent (e.g. a prospect list collected at a trade fair, permission for marketing requested on a form)

Purpose of processing personal data and of the register

Personal data is processed only for predefined purposes, which are the following:

• e.g. managing the customer relationship
• e.g. informing about our services

4. Personal data stored in the register

The customer register contains the following data:

Contact details

• name
• address
• email
• telephone number

Customer data

• information on purchased products / services

5. Rights of the data subject

The data subject has the following rights; requests to exercise them must be sent to contact details

Right of access

The data subject may check the personal data we have stored.

Right to rectification

The data subject may request that incorrect or incomplete data concerning them be rectified.

Right to object

The data subject may object to the processing of personal data if they consider that the personal data has been processed unlawfully.

Prohibition of direct marketing

The data subject has the right to prohibit the use of their data for direct marketing.

Right to erasure

The data subject has the right to request the erasure of their data if the processing of the data is not necessary. We will process the erasure request, after which we will either erase the data or state a justified reason why the data cannot be erased.

Please note that the controller may have a statutory or other right not to erase the requested data. The controller is obliged to retain accounting records for the period (10 years) specified in the Accounting Act. For this reason, material relating to accounting cannot be erased before the expiry of that period.

Withdrawal of consent

If the processing of personal data concerning the data subject is based solely on consent, and not e.g. on a customer relationship or membership, the data subject may withdraw their consent.

The data subject may appeal against the decision to the Data Protection Ombudsman

The data subject has the right to demand that we restrict the processing of disputed data until the matter has been resolved.

Right to lodge a complaint

The data subject has the right to lodge a complaint with the Data Protection Ombudsman if they consider that we are breaching the data protection legislation in force when processing personal data.

Contact details of the Commission for Personal Data Protection (Комисия за защита на личните данни): cpdp.bg

6. Regular sources of data

The information provided should include details of the nature of the data sources (e.g. whether the source is publicly or privately maintained, the type of organisation/industry/sector, and where the data originates from (e.g. EU or non-EU). The specific data source should as a rule be provided, unless this is impossible.

Customer data is regularly obtained: (describe how you collect customer data)

• e.g. from the customer themselves when the customer relationship is established
• e.g. from the customer themselves via an online form

7. Regular disclosures of data

If you do not disclose data:

As a rule, data is not disclosed for marketing purposes outside Company Ltd.

If you disclose data, e.g. as follows:

We disclose data to company x for purpose z. Company x has committed to complying with the requirements of the General Data Protection Regulation.

If you use e.g. a newsletter tool or similar, record it e.g. as follows:

We have ensured that all our service providers comply with data protection legislation. We regularly use the following service providers:

• company y

(Note! Make sure that your contracts with service providers take the General Data Protection Regulation into account.)

8. Duration of processing

Record how long the data is retained, or the general principles concerning the duration of processing.

• e.g. As a rule, personal data is processed for as long as the customer relationship is in force
• e.g. The data subject can remove themselves from our marketing list via the link contained in every marketing email we send.

9. Processors of personal data

Record who processes the data. For example, the customer register is processed by the employees of Organisation Ltd.

Also record here if you outsource the processing of personal data in connection with subcontracting or outsourcing. These may include e.g. an accounting firm or IT support with access to the information systems.

The controller and its employees process personal data. We may also partially outsource the processing of personal data to a third party, in which case we guarantee by contractual arrangements that personal data is processed in accordance with the data protection legislation in force and otherwise appropriately.

10. Transfer of data outside the EU

If data is not transferred outside the EU:

Personal data is not transferred outside the EU or the European Economic Area.

If data is transferred outside the EU:

Data is regularly transferred outside the EU or the European Economic Area. When data is transferred outside the EU and the EEA, we ensure an adequate level of protection of personal data, among other things by agreeing on matters relating to the confidentiality and processing of personal data in the manner required by legislation.

If data is transferred, record under section 6, regular disclosures, to whom and why the data is disclosed.

11. Automated decision-making and profiling

If you do not use the data for automated decision-making or profiling, record it e.g. as follows:

We do not use the data for automated decision-making or profiling.

If you use the data for automated decision-making or profiling, describe the use in an understandable way.

For profiling, explain the meaningful information about the logic involved in the processing, as well as the significance and the possible consequences of such processing for the data subject.

12. AI shopping assistant

The store offers an optional AI shopping assistant. It runs only if you open it and write something; every other part of the store works without it. What you write, and the answer you get back, is sent to Google, the provider of the Gemini model that generates the reply, for the sole purpose of answering your question. That call goes to the Gemini model on Google Cloud Vertex AI in the EU region europe-north1 — the same region the store itself runs in — so your text stays inside the EEA; see the section on international transfers.

Assistant messages are used only to answer you. We do not use them for advertising, for profiling or for automated decision-making, and we never sell them. We use the model provider on a paid plan, whose terms do not allow your messages to be used to train its models. The assistant cannot take a payment or change an order; a person handles anything that does. Please do not write card numbers, passwords or health information into it — a dietary or allergy detail you mention is sent with your message.

A conversation is kept with your chat session so the assistant can follow the thread, and is deleted automatically after 90 days at the latest. If you would rather your text was not processed this way, do not use the assistant: it is optional, and the catalogue, your account and checkout all work fully without it.