Privacy policy
Mandatory information on the rights of individuals regarding personal data protection
Information about the company processing your data:
Name: Shampeyn EOOD (Champagne Ltd)
UIC/BULSTAT: 206853338
Registered office and address of management: 99 James Bourchier Blvd, Sofia
Correspondence address: 99 James Bourchier Blvd, Sofia
Phone: +359 886 402 546
E-mail: k_bonchev@abv.bg
Website: www.champagne-winebar.com
Information about the competent personal data protection supervisory authority
Name: Commission for Personal Data Protection.
Registered office and address of management: 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592
Correspondence address: 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592
Phone: 02 915 3 518
Website: www.cpdp.bg
Shampeyn EOOD (Champagne Ltd) (hereinafter referred to as the “Controller” or the “Company”) carries out its activities in accordance with the Bulgarian Personal Data Protection Act and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. The purpose of this information is to inform you of all aspects of the processing of your personal data by the Company and of the rights you have in connection with that processing.
Legal basis for collecting, processing and storing your personal data
Art. 1. The Controller collects and processes your personal data in connection with the use of the online shop www.champagne-winebar.com and the conclusion of contracts with the Company on the basis of Art. 6(1) of Regulation (EU) 2016/679 (GDPR), and more specifically on the following grounds:
- Your explicit consent as a customer;
- Performance of the Controller's obligations under a contract with you;
- Compliance with a legal obligation to which the Controller is subject;
- The legitimate interests of the Controller or of a third party;
Purposes and principles of collecting, processing and storing your personal data
Art. 2. (1) We collect and process the personal data you provide to us in connection with the use of the online shop and the conclusion of a contract with the Company, including for the following purposes:
- creating an account and providing full functionality when using the online shop;
- concluding and performing a distance contract;
- identifying the contracting party;
- accounting purposes;
- statistical purposes;
- protecting information security;
- securing the performance of the contract for the provision of the relevant service;
- sending a newsletter, if you have requested it;
(2) We observe the following principles when processing your personal data:
- lawfulness, fairness and transparency;
- purpose limitation;
- relevance to the purposes of processing and data minimisation;
- accuracy and currency of the data;
- storage limitation in line with the purposes;
- integrity and confidentiality of processing and ensuring an appropriate level of security of personal data.
(3) When processing and storing personal data, the Controller may process and store personal data in order to protect the following legitimate interests:
- fulfilling its obligations towards the National Revenue Agency, the Ministry of the Interior and other state and municipal authorities.
What types of personal data our company collects, processes and stores
Art. 3. (1) The Company carries out the following operations with the personal data you provide, for the following purposes:
-
Registering a user in the online shop and performing a distance sales contract – the purpose of this operation is to create an account for using the online shop to purchase goods and to provide contact details for the delivery of purchased goods. Registering and creating an account is not a mandatory step for using the service, which is largely available without an account.
Conclusion of the impact assessment: Based on the impact assessment carried out, the operation “Registering a user in the online shop and performing a distance sales contract” is permissible and provides sufficient safeguards for the rights and legitimate interests of data subjects in accordance with the requirements of the GDPR. - Concluding and performing a commercial transaction with a customer or partner – the purpose of this operation is to conclude and perform a contract with a business partner or customer and to administer it. Given the limited scope of the personal data collected and the fact that some of it is collected from publicly available sources, an impact assessment of this operation is not necessary.
- Sending a newsletter – the purpose of this operation is to administer the sending of newsletters to customers who have requested to receive them. Given the limited scope of the personal data collected, an impact assessment of this operation is not necessary.
- Exercising the right of withdrawal or making a complaint – the purpose of this operation is to administer the process by which a customer exercises the right of withdrawal or makes a complaint. Given the limited scope of the personal data collected, an impact assessment of this operation is not necessary.
(2) The Controller processes the following categories of personal data and information for the following purposes and on the following grounds:
-
Your identification data (email address, name, etc.)
- Purpose for which the data is collected: 1) communicating with the user and sending information to them, 2) registering the user in the online shop, and 3) sending a newsletter.
- Legal basis for processing your personal data - By accepting the terms and conditions and registering in the online shop, placing an order without registration, or concluding a written contract, a contractual relationship is created between the Controller and you, on the basis of which we process your personal data – Art. 6(1)(b) GDPR. Your data for receiving the newsletter is processed on the basis of your explicit consent – Art. 6(1)(a) GDPR.
-
Delivery data (names, phone number, address, etc.)
- Purpose for which the data is collected: Performance of the Controller's obligations under the sales contract and delivery of the purchased goods.
- Legal basis for processing your personal data - By accepting the terms and conditions and registering in the online shop, placing an order without registration, or concluding a written contract, a contractual relationship is created between the Controller and you, on the basis of which we process your personal data – Art. 6(1)(b) GDPR.
-
Additional data provided by you – If you wish to complete your account, you may add your first name, surname and phone number.
- Purpose for which the data is collected: Supplementing the user information in the user's account.
- Legal basis for processing the data: You gave explicit consent to the processing of your personal data for one or more specific purposes – Art. 6(1)(a) GDPR – at the time of registering in the online shop. Providing this data is not required to register in the online shop.
(3) The Controller does not collect or process personal data that:
- reveals racial or ethnic origin;
- reveals political, religious or philosophical beliefs, or trade union membership;
- constitutes genetic or biometric data, data concerning health, or data concerning a person's sex life or sexual orientation.
(4) The personal data has been collected by the Controller from the data subjects themselves.
(5) The Company does not carry out automated decision-making using the data.
Art. 4. (1) The Company carries out the following operations with personal data provided by you as legal representatives or authorised agents of legal entities that are business partners, for the following purposes:
- Concluding and performing a commercial transaction: to conclude and perform a commercial transaction with a company, we process only the full name of the legal representative or of the person authorised by the company. Conclusion of the impact assessment: Given the small number of individuals whose data is processed and the limited amount of personal data collected, an impact assessment is not necessary for this operation.
(2) The personal data has been collected by the Controller from the data subjects themselves and from the Commercial Register at the Registry Agency.
(3) The Company does not carry out automated decision-making using the data.
Art. 5. The Controller may use cookies to provide full website functionality, improve the user experience, for statistical purposes, easier access, etc., to which you agree by using our website. You can control and/or delete cookies at any time through your browser settings. Cookies do not constitute personal data and are not used to identify visitors to and users of the online shop.
Retention period of your personal data
Art. 6. (1) The Controller stores your personal data for no longer than your account exists in the online shop. After your account is deleted, the Controller takes the necessary steps to erase and destroy all your data without undue delay, or to anonymise it (i.e. put it into a form that does not reveal your identity).
(2) The Controller processes the personal data you provided when placing an order without registering in the online shop until the order is completed, unless, when placing the order, you gave your explicit consent for your data to be processed for the purposes of improving the service, providing recommended content, individual terms and promotions, and for statistical purposes.
(3) The Controller stores the personal data you provided in connection with online orders for a period of 5 years in order to protect the Controller's legal interests in court or administrative disputes with users of the online shop.
(4) The Controller will notify you if the retention period needs to be extended in order to comply with a legal obligation, for the Controller's legitimate interests, or for other reasons.
(5) The Controller stores personal data that it is required to keep under applicable legislation for the relevant statutory period, which may exceed the lifetime of your account in the online shop or the completion of the order.
Art. 7. The Controller stores the personal data of the legal representatives of its business partners for the term of the contract, and in order to comply with the Controller's legitimate interests and legal obligations; this period may exceed the term of the contract concluded.
Transfer of your personal data for processing
Art. 8. (1) The Controller may, at its discretion, transfer some or all of your personal data to data processors in order to fulfil the processing purposes you have consented to, in compliance with the requirements of Regulation (EU) 2016/679 (GDPR).
(2) The Controller will notify you if it intends to transfer some or all of your personal data to third countries or international organisations.
Your rights in relation to the collection, processing and storage of your personal data
Withdrawal of consent to the processing of your personal data
Art. 9. (1) If you do not wish the personal data you have provided to be processed for marketing purposes and for receiving the newsletter, you may withdraw your consent to processing at any time by completing the consent withdrawal form in Annex No. 1, or by a request in free text, and sending it to us by email.
(2) Once we receive your request, we will send to the email address you specified for receiving newsletters and advertising messages a letter with detailed instructions for verifying your identity as a newsletter recipient and as the data subject of the personal data for which withdrawal of consent has been requested.
(3) Withdrawal of consent does not affect the lawfulness of the processing of personal data carried out by the Controller before the withdrawal.
Right of access
Art. 10. (1) You have the right to request and obtain from the Controller confirmation as to whether personal data concerning you is being processed, by sending a request in free text by email.
(2) You have the right to access the data concerning you, as well as the information relating to the collection, processing and storage of your personal data.
(3) Once we receive your request, we will send to the email address you used to register or place orders in the online shop a letter with detailed instructions for verifying your identity as the data subject of the personal data to which access has been requested.
(4) After verification under paragraph 3, the Controller will provide you, on request, with a copy of the personal data concerning you that is being processed, in electronic or other appropriate form.
(5) Access to the data is provided free of charge, but the Controller reserves the right to charge an administrative fee where requests are repetitive or excessive.
Right to rectification or completion
Art. 11. (1) You may at any time rectify or complete inaccurate or incomplete personal data concerning you via the “Edit profile” option.
(2) You may rectify or complete inaccurate or incomplete personal data concerning you directly through your account on the website, or by sending a request to the Controller by email using the form in Annex No. 4 or a request in free text.
Right to erasure (“right to be forgotten”)
Art. 12. (1) You have the right to request that the Controller erase some or all of the personal data concerning you, and the Controller is obliged to erase it without undue delay where one of the following grounds applies:
- the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
- you withdraw the consent on which the processing is based and there is no other legal ground for the processing;
- you object to the processing of personal data concerning you, including for direct marketing purposes, and there are no overriding legitimate grounds for the processing;
- the personal data has been unlawfully processed;
- the personal data must be erased to comply with a legal obligation under EU or Member State law to which the Controller is subject;
- the personal data has been collected in relation to the offer of information society services.
(2) The Controller is not obliged to erase personal data if it stores and processes it:
- for exercising the right of freedom of expression and information;
- for compliance with a legal obligation which requires processing under EU or Member State law to which the Controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in it;
- for reasons of public interest in the area of public health;
- for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes;
- for the establishment, exercise or defence of legal claims.
(3) To exercise your right to be forgotten, you need to send by email a request for erasure of the personal data processed by the Controller, using the form in Annex No. 2 or a request in free text. The Controller will then send to the email address you used to register or place orders in the online shop a letter with detailed instructions for verifying your identity as a user of the shop and as the data subject of the personal data for which erasure has been requested.
(4) Once we have verified the identity of the person making the request and of the data subject in accordance with the instructions sent to you, we will erase all the data we process about you, in accordance with paragraph 3.
(5) If you have an order that is being processed, the earliest point at which you can ask to be “forgotten” is upon successful completion of the order.
Right to restriction
Art. 13. You have the right to request that the Controller restrict the processing of data concerning you, by sending us a request in free text by email, where:
- you contest the accuracy of the personal data, for a period enabling the Controller to verify its accuracy;
- the processing is unlawful, but you do not want the personal data to be erased and request the restriction of its use instead;
- the Controller no longer needs the personal data for the purposes of the processing, but you require it for the establishment, exercise or defence of legal claims;
- you have objected to the processing, pending verification of whether the legitimate grounds of the Controller override your interests.
(2) Once we receive your request, we will send to the email address you used to register or place orders in the online shop a letter with detailed instructions for verifying your identity as a user of the shop and as the data subject of the personal data for which restriction of processing has been requested.
(3) After verification under paragraph 2, the Company will stop processing your data, but will not remove any posts you have made in the online shop, if any.
Right to data portability
Art. 14. (1) If you have consented to the processing of your personal data, or the processing is necessary for the performance of the contract with the Controller, or your data is processed by automated means, you may:
- ask the Controller to provide you with your personal data in a readable format and transfer it to another controller;
- ask the Controller to transfer your personal data directly to a controller you designate, where technically feasible.
(2) You may exercise the right to data portability by sending us by email the completed form in Annex No. 3 or a request in free text. The Controller will then send to the email address you used to register or place orders in the online shop a letter with detailed instructions for verifying your identity as a user of the shop and as the data subject of the personal data for which portability has been requested.
(3) After verification under paragraph 2, the Company will send the data it processes about you to the email address you specified, in XML format.
Right to receive information
Art. 15. You may ask the Controller to inform you of all recipients to whom the personal data for which rectification, erasure or restriction of processing has been requested has been disclosed. The Controller may refuse to provide this information if this proves impossible or would involve disproportionate effort.
Right to object
Art. 16. You may object at any time to the processing by the Controller of personal data concerning you, including where it is processed for profiling or direct marketing purposes.
Your rights in the event of a personal data breach
Art. 17. (1) If the Controller becomes aware of a breach of the security of your personal data that is likely to result in a high risk to your rights and freedoms, it will notify you of the breach without undue delay, together with the measures taken or to be taken.
(2) The Controller is not obliged to notify you if:
- it has implemented appropriate technical and organisational protection measures in respect of the data affected by the breach;
- it has subsequently taken measures ensuring that the breach is no longer likely to result in a high risk to your rights;
- notification would involve disproportionate effort.
Recipients of your personal data
Personal data processor Purpose of processing personal data
............................................... .....................................................................
............................................... .....................................................................
............................................... .....................................................................
(2) Personal data processors comply with all requirements of lawfulness and security when processing and storing your personal data.
Art. 19. The Controller does not transfer your data to third countries.
Art. 20. If your rights under the above or under applicable data protection legislation are infringed, you have the right to lodge a complaint with the Commission for Personal Data Protection, as follows:
Name: Commission for Personal Data Protection.
Registered office and address of management: 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592
Correspondence address: 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592
Phone: 02 915 3 518
Website: www.cpdp.bg
Art. 21. You can exercise all your rights regarding the protection of your personal data using the forms attached to this information. These forms are, of course, not mandatory, and you may submit your requests in any form that contains a statement to that effect and identifies you as the data subject.
Art. 22. Where consent relates to a transfer, the Controller describes the possible risks of transferring data to third countries in the absence of an adequacy decision and appropriate safeguards.
Annex No. 1
Form for withdrawal of consent to processing
Your name*: .........................
The email address you used in the online shop*: .........................
Contact details (e-mail)*: .........................
To
Shampeyn EOOD (Champagne Ltd) · UIC 206853338 · 99 James Bourchier Blvd, Sofia 1407 · +359 886 402 546 · champagnewineshop@abv.bg · www.champagne-winebar.com
I hereby withdraw my consent to the processing of the personal data I have provided for the purposes of receiving newsletters, advertising messages or other marketing materials, and I am aware of the conditions for withdrawing consent in accordance with the online shop's Mandatory information on the rights of individuals regarding personal data protection.
If your rights under the above or under applicable data protection legislation are infringed, you have the right to lodge a complaint with the Commission for Personal Data Protection, as follows:
Name: Commission for Personal Data Protection.
Registered office and address of management: 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592
Correspondence address: 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592
Phone: 02 915 3 518
Website: www.cpdp.bg
Annex No. 2
“Right to be forgotten” request – for erasure of personal data concerning me
Your name*: .........................
The email address you registered with or used for orders in the online shop*: .........................
Contact details (e-mail)*: .........................
To
Shampeyn EOOD (Champagne Ltd) · UIC 206853338 · 99 James Bourchier Blvd, Sofia 1407 · +359 886 402 546 · champagnewineshop@abv.bg · www.champagne-winebar.com
I request that all personal data you collect, process and store, provided by me or by third parties in connection with me, according to the identification given, be erased from your databases.
I declare that I am aware that some or all of my personal data may continue to be processed and stored by the controller in order to fulfil its legal obligations.
If your rights under the above or under applicable data protection legislation are infringed, you have the right to lodge a complaint with the Commission for Personal Data Protection, as follows:
Name: Commission for Personal Data Protection.
Registered office and address of management: 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592
Correspondence address: 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592
Phone: 02 915 3 518
Website: www.cpdp.bg
Annex No. 3
Request for personal data portability
Your name*: .........................
The email address you registered with or used for orders in the online shop*: .........................
Contact details (e-mail)*: .........................
To
Shampeyn EOOD (Champagne Ltd) · UIC 206853338 · 99 James Bourchier Blvd, Sofia 1407 · +359 886 402 546 · champagnewineshop@abv.bg · www.champagne-winebar.com
I request that all personal data concerning me that is collected, processed and stored in your databases be sent in XML format to:
e-mail: .........................
Receiving controller: .........................
Name: .........................
Identification number (UIC, BULSTAT, registration number with the Commission for Personal Data Protection): .........................
E-mail: .........................
If your rights under the above or under applicable data protection legislation are infringed, you have the right to lodge a complaint with the Commission for Personal Data Protection, as follows:
Name: Commission for Personal Data Protection.
Registered office and address of management: 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592
Correspondence address: 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592
Phone: 02 915 3 518
Website: www.cpdp.bg
Annex No. 4
Request for rectification of data
Your name*: .........................
The email address you registered with or used for orders in the online shop*: .........................
Contact details (e-mail)*: .........................
To
Shampeyn EOOD (Champagne Ltd) · UIC 206853338 · 99 James Bourchier Blvd, Sofia 1407 · +359 886 402 546 · champagnewineshop@abv.bg · www.champagne-winebar.com
I request that the following personal data you collect, process and store, provided by me or by third parties in connection with me, be rectified as follows:
Data to be rectified:
..................................................
Please rectify it as follows:
..................................................
If your rights under the above or under applicable data protection legislation are infringed, you have the right to lodge a complaint with the Commission for Personal Data Protection, as follows:
Name: Commission for Personal Data Protection.
Registered office and address of management: 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592
Correspondence address: 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592
Phone: 02 915 3 518
Website: www.cpdp.bg