Privacy notice

PERSONAL DATA PROCESSING POLICY of Wishcraft LTD.

It complies with the current rules on personal data protection, including the LPDP and EU regulation 2016/679 (GDPR). 

Information for the data controller:

Wishcraft LTD. is a company registered in the Commercial Register of the Registry agency with UIC 205975200, with headquarters and address of management: Smolyan, ul. Grude Voivoda 4,

Tel: + 359 98 88 55 41 E-mail: office@wishcraft.bg 

What are personal data:

These are data that may, in one way or another, lead to the identification of a person. Of course, they include name, PIN, and identity document data. In addition, there are others – phone number, address, email address, IP address, and photo. They are personal and data related to personal life – education, work experience, ethnicity, religion and others.

Personal data are only for individuals (people). Data about legal entities such as companies, associations and organizations (BULSTAT, address, telephone, email) are not personal data.

Special (Sensitive personal data):

There is one category of personal data that the GDPR treats in a more specific way. These are special personal data which were called "sensitive data" in the previous legislation. These include information revealing:

• racial or ethnic origin;
• Political views;
• religious or philosophical beliefs;
• Trade union membership;
• Genetic data and biometric data;
• State of health;
• Sex life or sexual orientation;
• Convictions and wrongdoing

We process your personal data on the following grounds:

• The contract concluded between us and your contract in order to fulfil our obligations under it;
• Your explicit consent – the purpose is stated in a case
• Under a statutory obligation

In the following paragraphs, you will find information about the processing of your personal data depending on the basis on which we process them.

FOR THE PERFORMANCE OF A CONTRACT OR IN THE CONTEXT OF PRE-CONTRACTUAL RELATIONS

We process your personal information to fulfil our contractual and pre-contractual obligations and to enjoy the rights under the contracts entered into with you.

Aims of the processing:

• Identifying your identity;

• managing and executing your request and executing a contract;

• preparing and sending an invoice/invoice for the services you use with us;

• keeping correspondence with ordering, query processing, problem reporting and more.

• preparation of a profile;

Based on the contract concluded between us and you, we process information about the type and content of the contractual relationship, as well as any other information related to the contractual relationship, including:

• personal contact information - contact address, email, telephone number;

• identification data - three names, a unique civilian or alien personal number, and permanent address;

• Data on orders made through the profile;

• emails, letters, and information about your troubleshooting requests, complaints, requests, complaints;

• credit or debit card information, bank account number, or other bank and payment information in connection with the payments made;

The processing of the personal data provided by us is obligatory for us to be able to conclude the contract with you and to fulfil it.

We provide your personal information to third parties, and our main goal is to provide you with quality, fast and comprehensive service.

We provide personal information to the following categories of recipients (data controllers):

• postal operators and courier companies;

• consultants in various fields.

The data collected on this basis are deleted 5 years after the termination of the contractual relationship, whether due to the expiry of the contract, termination or other reasons. The term is set by the 5-year statute of limitations for possible contract claims.

FOR THE PERFORMANCE OF REGULATORY OBLIGATIONS

The law may provide an obligation for us to process your personal data. In these cases, we are obliged to carry out the processing, such as:

• Obligations under the Law on Measures against Money Laundering;

• fulfilment of obligations related to distance selling, and off-premises sales provided for in the Consumer Protection Act;

• providing information to the Consumer Commission or third parties provided for in the Consumer Protection Act;

• providing information to the Commission for the protection of personal data in relation to the obligations laid down in the legislation on personal data protection;

• Obligations provided for in the Law on Accounting and the Tax and Social Insurance Procedure Code and other related normative acts in connection with the maintenance of lawful accounting;

• providing information to the court and to third parties, in the course of proceedings before a court, in accordance with the requirements of the applicable legal acts;

• age verification when shopping online.

The data collected in accordance with a foreseen obligation in the law are deleted after the collection and storage obligation is fulfilled or eliminated. For example:

• under the Accounting and Storage Act (11 years),

• obligations to provide information to the court, competent state authorities, etc. grounds provided for in current legislation (5 years).

Where an obligation is provided for by law, it is possible for us to provide your personal data to the competent state authority, natural or legal person.

AFTER YOUR AGREEMENT

We process your personal data on this basis only with your explicit, unambiguous and voluntary consent. We will not anticipate any adverse effect on you if you refuse to process your personal data.

Consent is a separate basis for the processing of your personal data and the purpose of the processing is specified therein and is not covered by the purposes listed in this policy. If you give us your appropriate consent and until the withdrawal or termination of any contractual relations with you, we prepare a suitable for you product/service proposals.

For this reason, we only process data for which you have given us your explicit consent. Specific data are determined on a case-by-case basis. Usually, the data include:

• email;
• telephone;
• address;
• names;

For this reason, we may share your information with marketing agencies and third parties.

Consents provided may be withdrawn at any time. Withdrawal of consent does not affect the performance of contractual obligations. If you withdraw your consent to the processing of personal data for any or all of the ways described above, we will not use your personal data and information for the purposes set out above.

Data we collect on this basis are deleted at your request or 1 year after the initial collection.

ANIMIZED DATA PROCESSING

We process your data for static purposes, that is, for analyses where the results are only aggregate and therefore the data are anonymous. It is impossible to identify a specific person from this information.

How we protect your personal information

In order to ensure adequate protection of the data of the company and its clients, we apply all necessary organizational and technical measures provided for in the Personal Data Protection Act.

For maximum security when processing, transferring and storing your data, we may use additional security mechanisms such as encryption, alias, etc.

CONSUMER RIGHTS

Each User of the site has all the rights for the protection of personal data in accordance with Bulgarian legislation and the law of the European Union.

Each User has the right to:

• Awareness (regarding the processing of personal data by the controller);

• Access to your own personal data;

• Correction (if data is incorrect);

• Deletion of personal data (right to be forgotten);

• Restriction of processing by the controller or the processor;

• Transferability of personal data between different administrators;

• Objection to the processing of his personal data;

• The data subject is entitled not to be subject to a decision based solely on automated processing involving profiling, which has legal effects on the data subject or similarly significantly affects it;

• The right to a judicial or administrative remedy if the data subject's rights have been violated.

The user may request deletion if one of the following conditions is true:

• Personal data are no longer needed for purposes for which they were otherwise collected or processed;

• The user withdraws his consent on which the data processing is based and there is no other legal basis for the processing;

• The data user objects to the processing and there are no legitimate grounds for the processing to take precedence;

• Personal data were processed illegally;

• Personal data must be deleted in order to comply with a legal obligation under Union or Member State law that applies to the controller;

• Personal data have been collected in connection with the provision of information society services to children and consent has been given by the parent responsible for the child.

The user has the right to restrict the processing of his personal data by the controller when:

• Challenge the accuracy of personal data. In this case, limiting processing is for a period that allows the controller to verify the accuracy of personal data;

• The processing is unlawful, but the User does not want the personal data to be erased but instead requires a restriction on their use;

• The controller no longer needs the personal data for the purposes of the processing, but the User requires it for the establishment, exercise or protection of legal claims;

• Object to the processing pending verification that the legitimate grounds of the Administrator take precedence over the interests of the User.

Right to portability.

The data subject shall have the right to receive the personal data concerning him that he has provided to the controller in a structured, widely used and machine-readable format and shall have the right to transfer that data to another controller without hindrance from the controller whose personal data are provided when processing is based on consent or contractual obligation and processing is carried out in an automated manner. When exercising its right to data portability, the data subject shall also be entitled to receive, directly, where technically feasible, the transfer of personal data from one controller to another.

Right to object.

Users have the right to object to the controller against the processing of their personal data. The data controller is obliged to suspend processing unless it proves that there are compelling legal grounds for processing that take precedence over the data subject's interests, rights and freedoms, or for the establishment, exercise or defence of legal claims. When objecting to the processing of personal data for direct marketing purposes, the processing should be stopped immediately.

Complaint to the supervisory authority

Each User has the right to file a complaint against unlawful processing of his / her personal data to the Data Protection Commission or to the competent court.

ABOUT US

If you have any questions or comments about this policy, please contact us:

• tel. +359 98 885541

• Email address: office@wishcraft.bg

CONTACTS OF THE PERSONAL PROTECTION AGENCY

• Address: 2, Prof. Tsvetan Lazarov Blvd., 1592 Sofia,

• Phone: +359 2 915 3555

• Email: kzld@cpdp.bg

• Website: www.cpdp.bg

This privacy statement was last modified on: 03.05.2020