loading icon

Personal Data Protection Policy

Personal Data Protection Policy

 

1.       About us:

This policy is designed by LAVENA AD, UIC 837066835, having its seat and registered address in the city of Shumen, Industrial Area, zip code 114, tel.: 054850138; fax: 054850119; e-mail: office@lavena.bg, dp@lavena.bg

The policy applies to all subsidiaries of LAVENA AD, and namely:

LAVENA MERCHANIDISING EOOD, UIC 200760724, having its seat and registered address in the city of Sofia, 20-22 Zlaten Rog St.;

LAVENA AGRO EOOD, UIC 200494177, having its seat and registered address in the city of Shumen, Industrial Area, zip code 114,

Hereinafter referred to as “Companies”, “Subsidiaries” and/or “Lavena Group Companies”. Each of the above Companies may be Controller or Processor of personal data of natural persons within the meaning of the Personal Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)).

 

2.       Information on the protection of personal data:

 

LAVENA AD and the Lavena Group Companies process personal data of natural persons for the purposes of providing more diverse products and/or services of better quality. We have continuous commitment to improve our service and therefore we establish strategic business partnerships trying to satisfy our customers’ needs while using our product portfolio.

Data confidentiality is crucial for us and for the success of our business. The security of the data of natural persons is ensured through appropriate technical and organizational measures aimed at not allowing unauthorized access, wrongful use, loss or destruction of information. We collect and process personal data in strict observance of the legal requirements, while understanding that personal data processing is not unlimited and is done with specific purpose.

 

3.       Grounds for personal data processing

3.1.  We process personal data when this is required by legal regulations and while fulfilling statutory obligations:

·         laid down in the Accounting Act and the Tax Insurance Procedure Code, and other related legal regulations with regard to accounting;

·         laid down in the Public Offering of Securities Act and other related legal regulations;

·         in case of remote sales and/or sales outside the points of sale laid down in the Consumer Protection Act;

·         for provision of information to the Consumer Protection Commission or to third parties laid down in the Consumer Protection Act;

·         for provision of information to the court or to third parties in accordance with the requirements of the procedure and substantive legal regulations applicable to the court proceedings;

·         for provision of information to the Personal Data Protection Commission in relation to the obligations laid down in the General Data Protection Regulation (Regulation 2016/679);

3.2. Personal data processing in pre-contractual relationships and for fulfillment of contractual obligations

We process personal data for provision of products and/or services you have requested from us while fulfilling contractual obligations and rights. Processing is carried out for the purposes of:

·         identification of the customer via sales channel;

·         handling and completion of an order for products and/or services, performance of specific contract;

·         making an offer for entering into contract;

·         making and sending a bill/ invoice for products and/or services from us;

·         ensuring the administration and collection of amounts due for products and/or services;

·         notifying about products and/or services, sending different notices for problems, errors or for reply to received messages, complaints;

·         drafting aggregate statistics for sales and/or services, and/or customers that we may provide to third persons in case this information does not contain personal data;

·         analyzing and making consumer profile for determining an appropriate offer;

·         protecting and ensuring the safety of our business, our employees and customers;

·         assessing and measuring the efficiency of our advertisements, and offering appropriate advertisements;

·         processing data from bills/ invoices for purposes compatible with the initial objective of their collection, for the purposes of having a general view on our products and/or services;

·         receiving and analyzing products and/or services based on anonymous or personalized information, including in the course of cooperation with third parties, for product and/or service development;

·         processing data, including from joint controllers, upon entering into contracts, assignment, reporting, acceptance and payment settlement.

 

3.3. Personal data processing on the basis of received data subject’s consent, including in marketing activities and organizing games and promotions

The consent is grounds for personal data processing and the objective must be specified therein. In specific cases, personal data are processed only after prior consent. Upon giving the relevant consent and up to its withdrawal and/or termination, we are able to make appropriate proposals for products and/or services of Lavena AD and/or of Lavena Group Companies, while analyzing personal data and/or consumption data.

Any given consent may be withdrawn at any time and does not affect the processing before the withdrawal, as well as when the processing is required for fulfillment of contractual obligations, if any. Upon withdrawal of the consent for personal data processing for any or all objectives, Lavena AD and/or the Lavena Group Companies shall discontinue the processing for the objectives specified in the withdrawal.

The withdrawal of the consent does not affect the legality of processing based on a consent given before its withdrawal. The consent may be withdrawn in the way specified therein or by using our contact details.

We may also collect personal data of natural persons when we organize promotions and marketing campaigns in the store network and on the internet, in our capacity of controllers thereof (organizers of games and promotions). The specific details about a campaign, types of personal data, storage time limit, objectives, etc., are described in the general terms and conditions (rules) of each organized campaign, which the consumers must always accept before giving personal data.

Personal data are submitted by natural persons on voluntary basis. The objectives for their processing may vary and must be stated in the general terms and conditions (rules), for example, organizing specific game and nominating the participant-winner to get the prize; making contact with the winning participant for the purposes of giving the prize; protection of the rights and legitimate interests of the Lavena Group Companies and of third parties against claims.

Cookies – such data may be possibly collected in the course of participation in marketing activities and/or upon visiting the Companies’ websites, and namely: https://lavena.bg/bg, https://bochko.bg/, https://www.bebble-cosmetics.com/, https://maternea.bg/, https://maternea-cosmetics.com/

https://www.footness-cosmetics.com/, https://www.myrose.bg/, https://sport-ready.com/, https://www.hands-work.com/. Cookies are data that our website sends to your browser and then retains this information in your system. Cookies enable our website to “remember” the information about your preferences or until you exit the browser window you are currently using (in case of temporary cookies), or until you deactivate or delete such cookies. Many consumers prefer using cookies that help them while navigating within the website as smoothly as possible and without any interruption.

The Companies use the cookies in order to help data subjects – website visitors, and namely:

·         to identify the computer they access through;

·         to recognize and serve consumers better;

·         to improve the content and navigation of the website;

·         to study the consumer interest;

 

3.4.  Personal data processing with view of protection of legitimate interests

We use video surveillance on the territory of the Companies with view of our legitimate interest to protect the property of the Companies and to ensure the safety of our employees and workers.

 

4.       PROTECTION OF YOUR PERSONAL DATA

We apply organizational and technical measures as set out by the legislation and applicable in our organizational practice in order to ensure the protection of data of employees/ workers, consumers and our business partners. The Company has established a Working Group on Data Protection to support the personal data protection and security processes. For the purposes of maximum safety while processing, transferring and storage of personal data, we can use protection mechanisms, such as encryption, etc.

 

5.       PERSONAL DATA DESTRUCTION

Processing of personal data is terminated for the purposes related to contractual relationships after contract termination but they are not destroyed before the expiration of one year of the termination of a contract or until the final settlement of all financial obligations and expiration of the statutory obligations for data storage:

·         under the Accounting Act for storage and processing of accounting data (11 years);

·         under the Accounting Act for storage of salary payrolls (50 years);

·         under the Obligations and Contracts Act, expiration of specific time limitations for filing claims (5 years);

·         under the Electronic Messages Act for storage and submission of information for the purposes of detection and investigation of crimes, liabilities (6 months);

·         under obligations for provision of information to court, competent state authorities, and other grounds as set out in the applicable legislation (5 years).

When personal data are collected in relation to organized promotions and marketing activities, they are stored for the shortest possible time after the end of the relevant activity, respectively, after the expiration of the time period for receipt of prizes by the consumers, but for not more than 3 (three) months after the expiration of the time periods for receipt of prizes or termination of the relevant promotion. The time limits for processing, storage and destruction of personal data are described in the general terms and conditions of each marketing activity, and if no such information is provided, the provisions of this Policy shall apply.

 

6.       SHARING PERSONAL DATA WITH THIRD PARTIES

Submitting personal data to third parties is done mainly for the purposes of quality and comprehensive service – products and/or services we offer should meet the consumers’ expectations. Third parties may be, for example, courier companies, accounting houses, auditors, etc.

Personal data are not submitted to third parties before we are sure that technical and organizational measures for the protection of these data exist. In this case, we remain responsible for the confidentiality and security of personal data.

 

7.       TRANSFER OF PERSONAL DATA BY CATEGORIES OF RECIPIENTS. PERSONAL DATA PROCESSORS

7.1. Persons processing data on behalf of Lavena AD:

·         distributors of Lavena AD who act as representatives of the company in the course of the sale of products and/or services;

·         persons employed by Lavena AD under service agreements who support the sales, logistics, supply and other processes;

·         persons who maintain, by virtue of contract, any equipment, software and hardware used for personal data processing and necessary for the building of the company’s network, and for providing services, such as technical support, etc.;

·         providers of electronic certification services, and any document related to the provision of a product or service is signed by electronic signature;

·         banks that administer the payments made by us;

·         security companies licensed to carry out private security business in relation to the processing of video recordings and/or ensuring the access regime in the enterprise – for Lavena AD;

·         persons providing consultancy companies in different areas;

·         authorities, institutions and persons we are obliged to provide personal data with, by virtue of the applicable legislation;

·         persons, post operators, with view of sending consignments containing contracts, agreements and other documents, and the need to verify the identity upon delivery thereof;

·         claim collection or securing companies – claim collection companies, credit agencies, which, through mandate or in other way, administer and collect claims;

·         companies that are performers of organized games and other marketing activities in the store network and on the internet.

 

7.2.  Persons processing personal data on their own behalf

competent authorities, which, by virtue of legal regulation, have powers to request the transfer of personal data – courts, prosecutor’s office, regulatory authorities.

Any of the Lavena Group Companies may be a personal data Processor by Lavena AD’s assignment.

 

8.       RIGHTS IN RELATION TO PERSONAL DATA PROCESSING

Right to information

You have right of:

 

·         information for whether your personal data are processed, for the purposes of the processing, for the categories of data and for the recipients to which data are disclosed;

·         communication in understandable form, containing your personal data that are processed and information for their source;

·         information for each automated personal data processing related to you, if carried out.

 

Right to rectification

At any time during the processing of incomplete or erroneous personal data, you have the right to request:

 

·         to have the incomplete personal data rectified;

·         to have incomplete personal data completed, including by means of providing a supplementary statement.

 

Right to erasure

You have the right to request erasure:

 

·         when the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

·         to withdraw consent for processing;

·         personal data have been unlawfully processed;

·         for compliance with a legal obligation in Union or Member State law to which the controller is subject.

 

Right to restriction of processing

You have the right to request restriction of processing upon:

 

·         the accuracy of the personal data is contested for a period enabling us to verify their accuracy;

·         data processing is unlawful but instead of erasing them, you request their restricted processing;

·         you need them for the establishment, exercise or defence of legal claims, and we do not need such data;

·         you have objected to processing of data pending the verification whether the grounds are legitimate.

 

Right to portability

You may ask us to provide the personal data you have submitted to us in organized, arranged, structured, commonly used electronic format if:

 

·         we process data based on contract and on consent based on statement, which may be withdrawn or on contractual obligation;

·         the processing is carried out by automated means.

 

Right to object

At any time and on grounds relating to particular situation, you have the right to:

 

·         object to processing of personal data in case of existence of legal grounds to this effect;

·         in case of reasonable objection, the personal data of the relevant natural person may not be processed any more;

·         object to processing of personal data for the purposes of direct marketing.

 

Right to lodge a complaint

You have the right to lodge a complaint at a regulatory authority within EU and to the Personal Data Protection Commission:

 

Name: Personal Data Protection Commission

Seat and registered address: city of Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.

Mailing address: city of Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.

Telephone: 02 915 3 518

Email: kzld@government.bg, kzld@cpdp.bg

Website: www.cpdp.bg

 

 You can file an application for exercising of rights personally or through expressly authorized person with notarized power of attorney. The application may be sent online in accordance with the Electronic Document and Electronic Signature Act. Within 14 days of filing the application, we will make a decision on it. In case of objective need of longer time limit – for the purposes of collecting all requested data or serious difficulties for our work, this time limit may be extended to 30 days.

 

9.       AMENDMENTS TO AND UPDATE OF THE PERSONAL DATA PROTECTION POLICY OF LAVENA AD and the Lavena Group Companies.

This Personal Data Protection Policy shall be regularly updated. In case material changes are needed, notices shall be published on our Website at http://lavena.bg.

 We recommend you to check our Personal Data Protection Policy on regular basis to update yourself on personal data protection.

 You can find the Privacy Terms and Conditions of our website and detailed information here.