PRIVACY AND PERSONAL DATA PROTECTION POLICY
This Privacy Policy aims to inform visitors and users of the website www.micopurea.com, available at [website address], about how their personal data are collected, used, stored and protected.
The Policy has been prepared in accordance with applicable personal data protection legislation, including Regulation (EU) 2016/679 (“GDPR”) and applicable Bulgarian legislation.
- Personal data controller
The controller of the personal data collected through the website is:
MICOPUREA LTD. Mariyana Stefanova Nesheva
UIC/BULSTAT: 208431734
Registered office and management address: Sofia, Serdika District, Block 21, Floor 1
Phone: +359878552526
E-mail: info@micopurea.com
hereinafter referred to as the “Controller”.
For questions relating to the processing and protection of personal data, you may contact us at the e-mail address provided above.
- What personal data we may collect
Depending on how you use the website, we may process the following categories of personal data:
– first and last name;
– telephone number;
– e-mail address;
– delivery address and/or correspondence address;
– data required for issuing accounting documents;
– information provided through a contact form or during communication with us;
– information about orders placed;
– technical information about the device and browser used;
– IP address;
– information about how you use the website, where applicable and permitted by the cookies in use.
The Controller does not collect more personal data than is necessary for the specific purpose of processing.
- For what purposes we use personal data
Personal data may be processed for the following purposes:
3.1. Processing and fulfillment of orders
When an order is placed through the website, personal data are used for:
– processing and confirming the order;
– contacting the customer about the order;
– preparing and delivering the ordered products;
– issuing the necessary accounting documents;
– handling complaints, returns and other matters related to the order.
The legal basis is the necessity of processing for the performance of a contract with the customer and/or taking steps at the customer’s request before entering into a contract.
3.2. Contact with users
When you send us an inquiry by e-mail, contact form or another communication channel, we use the information provided to respond to the inquiry and carry out the necessary communication.
The legal basis is taking action at the request of the data subject and/or the Controller’s legitimate interest in responding to inquiries received.
3.3. Compliance with legal obligations
Personal data may be processed where necessary to comply with obligations arising from applicable legislation, including accounting and tax legislation.
3.4. Website security and prevention of abuse
We may process technical data, including IP addresses and log data, where necessary for website security and for the prevention of fraud, abuse, malicious actions and other violations.
The legal basis may be the Controller’s legitimate interest in protecting the website, its systems and its users.
3.5. Marketing and advertising communications
Where applicable, we may send advertising and marketing communications only where the required legal basis exists, including consent where such consent is required.
The recipient has the right to opt out of receiving marketing communications at any time.
- Cookies
The website may use cookies and similar technologies.
Cookies may be necessary for the proper functioning of the website, for remembering certain settings, for traffic analysis or for marketing purposes.
Where consent is required for the use of certain cookies, they are activated only after the relevant consent has been provided.
Users can manage their cookie preferences through the cookie management mechanism available on the website and/or through their browser settings.
- Who we may share personal data with
Depending on the specific service and purpose of processing, personal data may be disclosed to:
– courier companies and delivery providers where necessary to fulfill an order;
– accountants and accounting firms;
– hosting, technical support and IT service providers;
– payment service providers, where applicable;
– e-mail and communications service providers;
– state and municipal authorities where disclosure is required by law;
– other personal-data processors where necessary to provide the website’s services.
The Controller takes the necessary measures to ensure that persons processing personal data on its behalf provide an appropriate level of protection.
- Transfer of data outside the European Economic Area
Where the services used involve the transfer or processing of personal data outside the European Economic Area, the Controller takes the necessary steps to ensure that the data are transferred lawfully in accordance with the GDPR.
Where applicable, adequacy decisions, standard contractual clauses or other appropriate safeguards provided for by law are used.
- Personal data retention period
Personal data are stored only for the period necessary to fulfill the purposes for which they were collected, unless the law requires or permits a longer period.
For example:
– data relating to orders and accounting documents – for the periods provided for by applicable accounting and tax legislation;
– data from contact inquiries – for the period necessary to process the inquiry and subsequent communication, unless another legal basis exists for longer retention;
– data processed on the basis of consent – until consent is withdrawn or the applicable period expires, unless another legal basis for processing exists.
After the applicable retention period expires, the data are deleted or anonymized where technically possible and applicable.
- Consumer rights
Where the applicable conditions are met, you have the right:
– to receive information about the processing of your personal data;
– to request access to your personal data;
– to request correction of inaccurate or incomplete data;
– to request deletion of personal data;
– to request restriction of processing;
– to object to certain types of processing;
– to receive your personal data in a structured, commonly used and machine-readable format, where applicable;
– to withdraw your consent at any time when the processing
