Privacy Policy

Information regarding the competent supervisory authority for personal data protection

Name: Commission for Personal Data Protection

Seat and registered address: Sofia 1592, Prof. Tsvetan Lazarov Blvd. No. 2

Address for correspondence: Sofia 1592, Prof. Tsvetan Lazarov Blvd. No. 2

Phone: 02 915 3 518

Website: www.cpdp.bg

Brayta Gyokovi OOD, (hereinafter referred to as "Administrator" or "Company") carries out its activities in accordance with the Personal Data Protection Act and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. This information aims to inform you about all aspects of the processing of your personal data by the Company and your rights in connection with this processing.

Grounds for collecting, processing and storing your personal data

Art. 1. The Administrator collects and processes your personal data in connection with the use of the lordbg.com online store and the conclusion of contracts with the company on the grounds of Art. 6, para. 1, Regulation (EU) 2016/679 (GDPR), and more specifically on the following grounds:

• Explicit consent received from you as a customer;
• Performance of the Administrator's obligations under a contract with you;
• Compliance with a legal obligation applicable to the Administrator;
• For the purposes of the legitimate interests of the Administrator or a third party;

Purposes and principles for collecting, processing and storing your personal data

Art. 2. (1) We collect and process the personal data you provide to us in connection with the use of the online store and the conclusion of a contract with the company, including for the following purposes:

• creating a profile and providing full functionality when using the online store;
• conclusion and performance of a distance contract;
• identification of a party to the contract;
• accounting purposes;
• statistical purposes;
• information security protection;
• ensuring the performance of the contract for the provision of the respective service.
• sending a newsletter if you wish;

(2) We adhere to the following principles when processing your personal data:

• lawfulness, fairness and transparency;
• purpose limitation;
• data minimization and relevance to processing purposes;
• accuracy and up-to-dateness of data;
• storage limitation for the purpose of achieving the goals;
• integrity and confidentiality of processing and ensuring an appropriate level of security of personal data.

(3) When processing and storing personal data, the Administrator may process and store personal data for the purpose of protecting the following legitimate interests:

• fulfillment of its obligations to the National Revenue Agency, the Ministry of Interior and other state and municipal authorities.

What types of personal data our company collects, processes and stores

Art. 3. (1) The Company performs the following operations with the personal data you provide for the following purposes:

• User registration in the online store and performance of a distance purchase and sale contract – the purpose of this operation is to create a profile for using the online store for purchasing goods and providing contact data for delivery of purchased goods. Registration and creation of a profile for using the online store is not a mandatory step for the provision of the service and it is largely accessible even without creating a profile.
  Conclusion from the impact assessment: Based on the impact assessment carried out, the operation "User registration in the online store and performance of a distance purchase and sale contract" is permissible and provides sufficient guarantees for the protection of the rights and legitimate interests of the data subjects in accordance with the requirements of the GDPR.
• Conclusion and performance of a commercial transaction with a client or partner – the purpose of this operation is the conclusion and performance of a contract with a commercial partner or client and its administration. Given the limited scope of personal data collected and the fact that some of it is collected from publicly available sources, an impact assessment is not necessary for this operation.
• Sending a newsletter – the purpose of this operation is to administer the process of sending newsletters to clients who have indicated that they wish to receive them. Given the limited scope of personal data collected, an impact assessment is not necessary for this operation.
• Exercising the right of withdrawal or making a complaint – the purpose of this operation is to administer the process of exercising the right of withdrawal or complaint by the client. Given the limited scope of personal data collected, an impact assessment is not necessary for this operation.

(2) The Administrator processes the following categories of personal data and information for the following purposes and on the following grounds:

• Your identifying data (email, name, etc.)
  • Purpose for which the data is collected: 1) Contacting the user and sending information to them, 2) for the purposes of user registration in the online store, and 3) for sending a newsletter.
  • Grounds for processing your personal data – By accepting the general terms and conditions and registering in the online store or placing an order without registration, or by concluding a written contract, a contractual relationship is created between the Administrator and you, on which basis we process your personal data – Art. 6, para. 1, letter (b) GDPR. Your data for sending a newsletter is processed based on your explicit consent – Art. 6, para. 1, letter (a) GDPR.
• Delivery data (names, phone, address, etc.)
  • Purpose for which the data is collected: Fulfillment of the administrator's obligations under a purchase and sale contract and delivery of the purchased goods.
  • Grounds for processing your personal data – By accepting the general terms and conditions and registering in the online store or placing an order without registration, or by concluding a written contract, a contractual relationship is created between the Administrator and you, on which basis we process your personal data – Art. 6, para. 1, letter (b) GDPR.
• Additional data provided by you – If you wish to supplement your profile, you can fill in your first name, last name, and phone number.
  • Purpose for which the data is collected: Supplementing user information in their user account.
  • Grounds for data processing: You have given explicit consent to the processing of your personal data for one or more specific purposes – Art. 6, para. 1, letter (a) of the GDPR at the time of registration in the online store. The provision of this data is not mandatory for registration in the online store.

(3) The Administrator does not collect or process personal data relating to the following:

• revealing racial or ethnic origin;
• revealing political, religious or philosophical beliefs, or trade union membership;
• genetic and biometric data, data concerning health or data concerning a person's sexual life or sexual orientation.

(4) Personal data is collected by the Administrator from the persons to whom it relates.

(5) The Company does not perform automated decision-making with data.

Art. 4. (1) The Company performs the following operations with the personal data provided by you, as legal representatives or authorized representatives of legal entities-commercial partners, for the following purposes:

• Conclusion and performance of a commercial transaction: For the conclusion and performance of a commercial transaction with a commercial company, we process only the full names of the legal representative or the person authorized by the company. Conclusion from the impact assessment: Given the small number of natural persons whose data is processed and the limited volume of personal data collected, an impact assessment is not necessary for this operation.

(2) The personal data is collected by the Administrator from the persons to whom it relates and from the Commercial Register at the Registry Agency.

(3) The Company does not perform automated decision-making with data.

Art. 5. The Administrator may use so-called "cookies" for the purposes of providing full website functionality, improving user experience, statistical purposes, easy access, etc., which you agree to by using our website. You can control and/or delete "cookies" at any time through the settings of your browser. "Cookies" do not constitute personal data and are not used to identify visitors and users of the online store.

Period of storage of your personal data

Art. 6. (1) The Administrator stores your personal data for a period no longer than the existence of your profile in the online store. After deleting your profile, the Administrator takes the necessary care to delete and destroy all your data without undue delay or to anonymize it (i.e. to render it in a form that does not reveal your identity).

(2) The Administrator processes your personal data that you have provided when placing an order without registration in the online store, until the order is completed, unless you have given your explicit consent when placing the order for your data to be processed for the purposes of improving the service, providing recommended content for you, individual conditions, promotions, as well as for statistical purposes.

(3) The Administrator stores your personal data provided in connection with online orders for a period of 5 years for the purposes of protecting the legal interests of the Administrator in judicial or administrative disputes with users of the online store.

(4) The Administrator informs you in case the data storage period needs to be extended due to a regulatory obligation or due to the legitimate interests of the Administrator or other party.

(5) The Administrator stores personal data that it is required to keep by virtue of applicable law for the relevant foreseen period, which may exceed the period of existence of your profile in the online store or until the order is completed.

Art. 7. The Administrator stores the personal data of the legal representatives of its commercial partners for the term of the contract, to comply with the legitimate interests and legal obligations of the Administrator, and this period may exceed the term of the concluded contract.

Transfer of your personal data for processing