PERSONAL DATA POLICY
Thank you for choosing B. Version!
Version, as a part of Werderon Ltd., UIC 204397455, (hereinafter referred to as “Administrator” or “Company”) respects YOUR need for privacy and confidentiality and therefore operates in accordance with the Law on Protection of Personal Data and Regulation (EC) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data.
This policy is intended to inform you of the main aspects of the processing of your personal data by the Company and the rights you have in relation to such processing.
Please note that this information may be modified to reflect changes in applicable laws or in our privacy policies.
1. Definitions
These definitions are based on Regulation (EU) 2016/679
1.1. Personal data
Personal Information – any information that can be used to identify an individual (“user”). An individual who can be identified directly or indirectly, in particular by specifying information such as name, location data, online identifier and more.
1.2. Data subject / User
Data subject (“user”) is any identified or identifiable natural person whose personal data are processed by us under the terms of the Regulation.
1.3. Processing
Processing, storing, adapting or modifying, retrieving, consulting, using, disclosing by transmitting, distributing or otherwise providing or combining, limiting, deleting or destroying personal data.
1.4. Restriction of processing
Restriction of processing is the marking of stored personal data in order to limit their processing in the future.
1.5. Profiling
Profiling – any form of automated processing of personal data.
1.6. Administrator
The administrator, in this case, Werderon LTD, signifies a natural or legal person, public body, agency or other entity that alone or jointly with others determines the purposes and means for the processing of personal data; where the purposes and means of such processing are determined by Union law or the law of a Member State, the administrator or the specific criteria for determining it may be laid down in Union law or in a Member State law
1.7. Consignee
The recipient is a natural or legal person, public authority, agency or other body to which personal data are disclosed, whether third party or not. Public authorities which may receive personal data in the context of a specific investigation in accordance with EU law are not considered as third parties; the processing of such data is in accordance with the applicable data protection rules in accordance with the purposes of the processing.
1.8. Third person
The third party is a natural or legal person, public authority, agency or body other than the data subject, the administrator, the processor and the persons who, under the direct right of the administrator or processor, have the right to process personal data.
1.9. Consent
The consent of the user is any free, specific, informed and unambiguous indication, by statement or by clear positive actions and consent to the processing of his personal data.
2. Legal reasons for collecting, processing and storing your personal data
Art. 1. The administrator collects and processes your personal data in relationship with the use of the B.Version e-shop and the contracts you conclude with the company pursuant to Art. 6, para. 1, Regulation (EC) 2016/679 (GDPR), and in particular on the following grounds:
- Your explicit consent as a client;
- Execution of the obligations of the Administrator under the contract with you;
- Compliance with a statutory duty applicable to the Administrator;
- For the legitimate interests of the Administrator or a third party;
3. Goals and principles of collecting, processing and storing your personal data
Art. 2. (1) We collect and process the personal data you provide to us in connection with the use of the e-shop and the conclusion of a contract with the Company, for the following purposes:
- creating an account and providing full functionality to use the online store;
- signing and executing a distance contract;
- individualisation of a party to the contract;
- accounting purposes;
- statistical objectives;
- protection of information security;
- ensuring the implementation of the contract for the provision of the respective service.
- Sending a newsletter at your request;
(2) We comply with the following principles when processing your personal data:
- legality, good faith and transparency;
- limitation of processing goals;
- relevance to processing goals and minimization of collected data;
- accuracy and timeliness of the data;
- Restriction of storage in order to achieve the objectives;
- integrity and confidentiality of processing and ensuring an adequate level of security of personal data.
(3) When processing and storing personal data, the Administrator may process and store personal data to protect its legitimate interests:
- fulfilling its obligations to the National Revenue Agency, the Ministry of Interior and other state and municipal authorities.
4. Types of personal data collected, processed and stored by the administrator
Art. 3. (1) The Company carries out the following operations with the personal data you provide for the following purposes:
- Registration of a consumer in the e-shop for the purpose of executing a distance purchase contract
- Conclusion and execution of a trade deal with a client or partner
- To send a newsletter for current offers
- To exercise a right of withdrawal or claim
(2) The administrator shall process the following categories of personal data and information for the following purposes and on the following grounds:
— Your individualized data (email, name, etc.)
- Purpose for which data is collected: 1) To contact the user and sending information to him, 2) to register a user in the online shop, and 3) For sending a newsletter.
- Reason for processing your personal data – By accepting the general terms and conditions and registering in the e-shop or placing an order without registration or upon entering into a written contract between the Administrator and you, a contractual relationship is created on which we process your personal data – Art. 6, para. 1, b. (b) GDPR. Your data for submitting a newsletter is processed at your explicit consent – Art. 6, para. 1, b. (s) GDPR.
— Delivery details (names, telephone, address, etc.)
- Purpose for which data is collected: Execution of obligations of the administrator under a contract for the purchase and sale of purchased goods.
- Reason for processing your personal data – By accepting the general terms and conditions and registering in the e-shop or placing an order without registration or upon entering into a written contract between the Administrator and you, a contractual relationship is created on which we process your personal data – Art. 6, para. 1, b. (b) GDPR.
— Additional data provided by you – If you want to add your profile, you can fill in the name, surname, phone number.
- Purpose for which data is collected: Adding user information to his/hers user account
— General Data and Information – The B. Version site collects general data and information when you visit it. This general information and information is stored in the log files of the server owned by Superhosting.BG Ltd., which strictly comply with the Privacy Policy. You can find information about this at https://www.superhosting.bg/web-hosting-page-terms-and-agreements.php#gdpr. Collected can be
– browser types and versions used,
– the operating system used by the access system,
– the site from which it reaches our website (the so-called References),
– the date and time of access to the website,
– IP address,
– the internet service provider,
– any other information that may be used in the event of a cyber attack on our site.
- Purpose for which the data is collected: (1) create the proper content of our site, (2) optimize the content of our site, (3) provide quality access to the information, (4) provide law enforcement authorities with the necessary criminal information prosecution in case of cyber attack.
The administrator analyzes statistically anonymously collected data and information in order to enhance data protection and security, and to ensure an optimal level of protection of the personal data it processes. Anonymous data in the server logs is stored separately from all personal data provided by the user.
(3) The administrator does not collect or process personal data relating to the following:
- discloses racial or ethnic origin;
- reveal political, religious or philosophical beliefs, or membership of trade unions;
- genetic and biometric data, health data, or sexual life or sexual orientation data.
(4) The personal data are collected by the Administrator from the persons to whom they relate.
(5) The company does not carry out automated decision making with data.
Art. 4. (1) The Company carries out the following operations with the personal data provided by you as legal representatives or proxies of legal persons/trading partners, for the following purposes:
- Conclusion and execution of a commercial transaction: For the conclusion and execution of a commercial transaction with a trading company, we process only the full names of the legal representative or the person authorized by the company.
(2) The personal data are collected by the Administrator from the persons to whom they refer also from the Commercial Register to the Registry Agency.
(3) The Company does not make automated decision making with data.
Art. 5. The administrator can use the so-called Cookies for the purpose of providing full functionality to the website, improving user experience, statistical purposes, facilitated access, etc. that you agree to when using our website. You can control and / or delete cookies at any time through the settings of your browser. Cookies are not personal data and are not used to identify visitors and users of the e-shop.
5. Term of storage of your personal data
Art. 6. (1) The administrator keeps your personal data for no longer than the existence of your online store account. After deleting your account, the Administrator takes the necessary care to erase and destroy all your data without unnecessary delay or to anonymize them (i.e. to bring them in a form that does not reveal your personality).
(2) The Administrator processes your personal data that you provided when ordering without registration in the online store until the order is completed unless you have given your explicit consent to the processing of your data to be processed for the purpose of improving the service, providing recommended content for you, individual terms, promotions, and for statistical purposes.
(3) The Administrator shall store your personal data provided in connection with online orders for a period of 5 years for the purpose of protecting the legal interests of the Administrator in legal or administrative disputes with online shoppers.
(4) The Administrator shall notify you, in case the data retention period is required to be extended in order to comply with a statutory obligation or in view of the legitimate interests of the Administrator or otherwise.
(5) The administrator keeps the personal data that he / she needs to keep under the applicable law for the relevant term, which may exceed the lifetime of your e-shop account or the completion of the order.
Art. 7. The administrator keeps the personal data of the legal representatives of its trading partners for the duration of the contract, for observing the legitimate interests and legal obligations of the Administrator, which may exceed the term of the concluded contract.
6. Transmission of your personal data for processing
Art. 8. (1) The administrator may, at its own discretion, transmit all or part of your personal data to processor personal data for the fulfillment of the processing purposes you have agreed to, subject to the requirements of Regulation (EC) 2016/679 (GDPR) .
(2) The Administrator notifies you, in the event of intention, to transfer part or all of your personal data to third countries or international organizations.
7. Your rights in collecting, processing and storing your personal data
7.1. Withdrawal of consent to process your personal data
Art. 9. (1) If you do not want your personal data to be processed for marketing purposes and receive a newsletter, you may at any time withdraw your consent for processing by completing the withdrawal form in Appendix 1 or by request in free text, and send it to us by email.
(2) Once we have received your request, we will send you the email you have provided to receive newsletters and advertising messages, a letter with detailed instructions for your verification as a recipient of newsletters and a person subject to the withdrawal of consent .
(3) Withdrawal of consent does not affect the lawfulness of the processing of personal data that the Administrator has performed so far.
7.2. Right of access
Art. 10. (1) You have the right to request and obtain from the Administrator a confirmation that personal data relating to you is being processed by submitting a request in free text by email.
(2) You have the right to access data relating to you as well as information relating to the collection, processing and storage of your personal data.
(3) Once we receive your request, we will send you a letter with detailed instructions for your verification as the subject of the personal data that you have been requested to send to the email you used to register or place orders in the e-shop.
(4) After the verification, according to para. 3, the Administrator provides you with a copy of the processed personal data relating to you on request in electronic or other appropriate form.
(5) The provision of access to the data is free of charge, but the Administrator reserves the right to impose an administrative fee in case of repeatability or excessive demand.
7.3. Right of adjustment or replenishment
Art. 11. (1) You may at any time correct or fill in inaccurate or incomplete personal data relating to you through the “Edit Account” option.
(2) You may correct or fill in the inaccurate or incomplete personal data relating to you directly through your website profile or by sending a request to the Administrator by email using the form in Appendix 4 or a free text request.
7.4. Right to delete (“to be forgotten”)
Art. 12. (1) You have the right to ask the Administrator to delete any or all personal data related to you and the Administrator has the obligation to delete them without undue delay when any of the following reasons exists:
- personal data is no longer needed for the purposes for which it was collected or otherwise processed;
- You withdraw your consent on which the processing of the data is based and there is no other legal basis for the processing;
- You object to the processing of personal data related to you, including for the purposes of direct marketing, and there are no legitimate grounds for processing that have an advantage;
- personal data has been tampered with;
- Personal data must be deleted to comply with a legal obligation under EU law or the law of a Member State that applies to the Administrator;
- personal data have been gathered in connection with the provision of information society services.
(2) The administrator is not obliged to delete the personal data if he / she keeps them and processes them:
- exercising the right to freedom of expression and the right to information;
- complying with a legal obligation that requires treatment provided for under EU law or the law of the Member State that applies to the Administrator or for the performance of a public interest task or the exercise of official authority;
- for reasons of public interest in the field of public health;
- for purposes of archiving in the public interest, for scientific or historical research or for statistical purposes;
- for the establishment, exercise or protection of legal claims.
(3) In order to exercise your right to be forgotten, you must email your request to delete your personal data that the Administrator processes by completing the form in Attachment 2 or by free text request, then the Administrator will send to the email you used to register or place orders in the e-shop, a letter with detailed instructions for your verification as a shop user, and the subject of the requested personal data.
(4) Once we have verified the identity of the person making the request and the person to whom the data relate in accordance with your instructions, we will delete all data we process for you in accordance with par. 3.
(5) If there is an order you are currently processing, the earliest point at which you can ask to be “forgotten” is when you successfully complete your order.
7.5. Right of limitation
Art. 13. You have the right to require the Administrator to limit the processing of your related data by sending us a request in free text by email when:
- question the accuracy of personal data for a period that allows the Administrator to verify the accuracy of personal data;
- processing is illegal, but you do not want personal data to be erased, but only to be restricted;
- The administrator no longer requires personal data for the purposes of processing, but you require them to identify, exercise or protect your legal claims;
- You have reproached the processing pending verification that the Administrator’s legal grounds have an advantage over your interests.
(2) Once we receive your request, we will send you the email that you used to register or place orders in the e-shop, a letter with detailed instructions for your verification as a shop user and subject of the requested personal data to limit processing.
(3) After the verification under para. 2, the Company will stop processing your data, but will not remove the posts you made in the online store, if any.
7.6. Right of portability
Art. 14. (1) If you have consented to the processing of your personal data or processing is necessary for the performance of the agreement with the Administrator, or if your data is processed in an automated manner, you may:
- ask the Administrator to provide you with your personal data in a readable format and transfer it to another Administrator;
- ask the Administrator to transfer your personal data directly to an administrator you provide when it is technically feasible.
(2) You may exercise the right of portability by sending us by e-mail a completed form according to Appendix 3 or a request in free text, after which the Administrator will send a letter to the email you used to register or place orders in the e-shop detailed instructions for your verification as a shop user and a subject of the personal data for which a request for portability is requested.
(3) After the verification under para. 2, the Company sends the data it processes for you in XML format to the email you specify.
7.7. Right to receive information
Art. 15. You may request the Administrator to inform you of all recipients to whom the personal data for which the correction, deletion or limitation of the processing was requested has been disclosed. The administrator may refuse to provide this information if this would not be possible or would require disproportionate effort.
7.8. Right of objection
Art. 16. You may at any time object to the processing of personal data by the Administrator that relates to it, including whether it is being processed for profiling or direct marketing purposes.
8. Your rights in violation of the security of your personal data
Art. 17. (1) If the Administrator detects a breach of the security of your personal data that may pose a high risk to your rights and freedoms, he shall notify you without undue delay of the breach and of the measures taken or to be taken .
(2) The administrator is not obliged to notify you if:
- has taken appropriate technical and organizational protection measures with respect to the data affected by the security breach;
- has subsequently taken measures to ensure that the violation will not lead to a high risk for your rights;
- notification would require disproportionate efforts.
9. Persons to whom your personal data are provided
Art. 18. (1) For the purposes of processing your personal data and providing the service in its full functionality and in view of your interests, the Administrator may provide the data to different contractors. These may be different courier companies, including, but if necessary not limited to the following persons that process data:
Personal data processor The purpose of personal data processing
Econt Express Ltd. for the purposes of delivery
Speedy AD for the purposes of delivery
Bulgarian Posts EAD for the purpose of delivery
(2) These processors of personal data comply with all requirements of legality and security in the processing and storage of your personal data, but Werderon LTD assumes no responsibility for failure to comply with the relevant legislation and regulation due to the fault of the specified or other necessary counteragents.
Art. 19. The administrator does not transfer your data to third countries.
Art. 20. In the event of a violation of your rights under the aforementioned or applicable personal data protection legislation, you have the right to file a complaint with the Personal Data Protection Commission as follows:
Name: Commission for Personal Data Protection.
Headquarters and address of management: Sofia 1592, 2 Prof. Tsvetan Lazarov
Address for correspondence: Sofia 1592, 2 Prof. Tsvetan Lazarov
Phone: 02 915 3 518
Website: www.cpdp.bg
Art. 21. You may exercise all your rights regarding the protection of your personal data through the forms attached to this information. Of course, these forms are optional and you can submit your requests in any form that contains a statement about this and identifies you as the data owner.
Art. 22. If the consent relates to a transfer, the Administrator shall describe the possible risks for the transfer of data to third countries in the absence of a decision on adequate protection and appropriate remedies.
Appendix 1
Form of withdrawal of consent for processing purposes
Your Name*: …………………….
Your email that you used in the e-shop *: …………………….
Feedback data (e-mail) *: …………………….
To
Name: Werderon Ltd
UIC / BULSTAT: 204397455
Address for correspondence: Sofia 1680, PO box. 96
E-mail:bv@byourversion.com
I hereby withdraw my consent to process the personal data I have provided for the purpose of receiving a newsletter, advertisement, or other marketing material by being familiar with the conditions for withdrawal of consent in accordance with the Mandatory Information on the Rights of the Royalty of the personal data of the e-shop.
In case of violation of your rights under the above or applicable data protection laws, you have the right to file a complaint with the Personal Data Protection Commission as follows:
Name: Commission for Personal Data Protection.
Headquarters and address of management: Sofia 1592, 2 Prof. Tsvetan Lazarov
Address for correspondence: Sofia 1592, 2 Prof. Tsvetan Lazarov
Phone: 02 915 3 518
Website: www.cpdp.bg
Appendix 2
Request “To Be Forgotten” – To Delete Personal Information Related To Me
Your Name*: …………………….
Your email with which you have signed up or used for e-shop orders *: …………………….
Feedback data (e-mail) *: …………………….
To
Name: Werderon Ltd.
UIC / BULSTAT: 204397455
Address for correspondence: Sofia 1680, PO Box 96
E-mail: …………………….
Please all personal data you collect, process and store provided by me or third parties that are related to me according to the identified identification to be deleted from your databases.
I declare that I am aware that some or all of my personal data may continue to be processed and stored by the administrator for the purpose of performing its legal obligations.
In case of violation of your rights under the above or applicable data protection laws, you have the right to file a complaint with the Personal Data Protection Commission as follows:
Name: Commission for Personal Data Protection.
Headquarters and address of management: Sofia 1592, 2 Prof. Tsvetan Lazarov
Address for correspondence: Sofia 1592, 2 Prof. Tsvetan Lazarov
Phone: 02 915 3 518
Website: www.cpdp.bg
Appendix 3
Request for portability of personal data
Your Name*: …………………….
Your email with which you have signed up or used for e-shop orders *: …………………….
Feedback data (e-mail) *: …………………….
To
Name: Werderon Ltd.
UIC / BULSTAT: 204397455
Address for correspondence: Sofia 1680, PO Box 96
E-mail: …………………….
I ask that all personal data relating to me that are collected, processed and stored in your databases be sent in XML format to:
e-mail: …………………….
Administrator receiving data: …………………….
Name: …………………….
Identification number (UIC, BULSTAT, registration number in CPDP): …………………….
E-mail: …………………….
In case of violation of your rights under the above or applicable data protection laws, you have the right to file a complaint with the Personal Data Protection Commission as follows:
Name: Commission for Personal Data Protection.
Headquarters and address of management: Sofia 1592, 2 Prof. Tsvetan Lazarov
Address for correspondence: Sofia 1592, 2 Prof. Tsvetan Lazarov
Phone: 02 915 3 518
Website: www.cpdp.bg
Appendix 4
Request for Data Correction
Your Name*: …………………….
Your email with which you have signed up or used for e-shop orders *: …………………….
Feedback data (e-mail) *: …………………….
To
Name: Werderon Ltd.
UIC / BULSTAT: 204397455
Address for correspondence: Sofia 1680, PO Box 96
E-mail: …………………….
Please provide the following personal data you collect, process and store provided by me or third parties that relate to me to be corrected as follows:
Details to be corrected:
…………………………………………..
Please be corrected as follows:
…………………………………………..
In case of violation of your rights under the above or applicable data protection laws, you have the right to file a complaint with the Personal Data Protection Commission as follows:
Name: Commission for Personal Data Protection.
Headquarters and address of management: Sofia 1592, 2 Prof. Tsvetan Lazarov
Address for correspondence: Sofia 1592, 2 Prof. Tsvetan Lazarov
Phone: 02 915 3 518
Website: www.cpdp.bg