Introduction

The security and proper use of personal data is of the utmost importance to us. Our Privacy Policy is not intended to set out rights and obligations, but to explain to users what personal data we process in connection with the provision of goods and services, why and how we process it, including when it is necessary to disclose personal data to third parties. It also provides information about the rights that users have in connection with the processing of their personal data by “Pakyov” Ltd.

For greater clarity and convenience, this Privacy Policy includes examples in many places that illustrate why and/or how “Pakyov” Ltd. processes users’ personal data. These examples do not form part of this Privacy Policy and are not exhaustive.

Core principles of personal data processing

We process personal data lawfully, fairly and in a transparent manner.

We process personal data collected for specified, explicit and legitimate purposes, and do not process it further in a manner incompatible with those purposes.

The personal data we process is adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed (“data minimisation”).

We take all reasonable steps to ensure that personal data is kept accurate and up to date, and that inaccurate data is erased or corrected without delay, having regard to the purposes for which it is processed (“accuracy”).

Personal data is kept in a form that permits identification of the data subject for no longer than is necessary for the purposes for which it is processed (“storage limitation”).

Personal data is processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (“integrity and confidentiality”).

Data controller

The data controller is “Pakyov” Ltd., UIC 207271020, with registered office and management address at Sofia 1505, Slatina district, 3 “Il. Dragostinov” St. If you have any questions about privacy at “Pakyov” Ltd., or wish to contact us regarding a personal data protection matter, you may reach our Data Protection Officer at: mail@pakyov.com.

This Privacy Policy may be amended in accordance with national and European legislation. Any amendment takes effect from the moment it is published on this page. We advise you to check our website regularly to stay informed of the latest changes. Our Privacy Policy will not be amended in a way that would allow weaker protection of our customers’ and users’ personal data without their written consent.

What personal data we process

We collect your personal data in order to provide our goods and services and to continuously improve them. The types of information we collect are as follows:

Information you provide to us

We receive and store any information you provide in connection with the services of “Pakyov” Ltd. — for example: your user profile, email address, phone number, delivery address, enquiries, requests for access to personal information, and so on.

Automatically collected information

We automatically receive and store certain types of information when you use the “Pakyov” Ltd. website, such as information about your usage, including your interactions with content and services available through the site. Like many websites, we use cookies and other unique identifiers and receive certain types of information when your web browser or device accesses the site. For example:

Internet Protocol (IP) address used to connect your computer or other device to the internet;
Email address and password;
Computer, device and connection information — device type and application version, browser type, browser plug-in types and versions, operating system, or time zone settings;
The location of your device or computer;
Content interaction information — downloads, streams, playback details including duration and number of simultaneous streams, and network quality data including information about your internet service provider;
Device metrics — application usage, connectivity data and any errors or failed events;
Site metrics — technical errors, your interactions with features and content, settings preferences, device location, and information about uploaded images and files (e.g. file name, dates, image location).

We may also use device identifiers, cookies and other technologies on devices, applications and web pages to collect browsing, usage or other technical information for fraud prevention purposes.

Information from other sources

We may receive information about you from other sources, such as delivery information for goods purchased through the site, or page view data.

What are cookies?

In order to provide our services and successfully deliver each of the products offered on the site, we use cookies. For more information about cookies and how we use them, please read our Cookie Policy.

The legal basis on which we collect and process your personal data

We collect and process your personal data lawfully and in accordance with this Privacy Policy. We process data only where you have given your explicit consent, or where processing is necessary for the performance of a contract to which you are a party, or to take steps at your request prior to entering into a contract (which includes simply using the site without having placed an order).

Processing is also necessary for the purposes of our legitimate interests — where without processing certain types of data we would be unable to provide our services, conclude a purchase contract, improve the site or our customer service. For example, collecting information about searches on the site is a legitimate interest of ours as it is a primary method of assessing the quality of our services.

Should you choose not to provide “Pakyov” Ltd. with the personal data required to conclude a purchase contract, “Pakyov” Ltd. will be unable to provide you with its goods and services.

Purposes of personal data processing

We process your personal data in order to provide and improve the goods and services on the site. These purposes include:

Purchase and delivery of products and services. We use your personal information to take and handle orders, deliver products and services, process payments and communicate with you about orders, products, services and promotional offers.

Providing, troubleshooting and improving services. We use your personal data to provide functionality, analyse performance, fix errors and improve the usability and effectiveness of the site.

Recommendations and personalisation. We use your personal data to recommend features, products and services that may be of interest to you, to identify your preferences and to personalise your experience on the site.

Compliance with legal obligations. In some cases we have a legal obligation to collect and process your personal data — for example, to fulfil obligations arising from accounting and tax legislation, or to provide a statutory guarantee under consumer protection law.

Communicating with you. We use your personal data to communicate with you about the goods and services we provide through various channels (phone, email, chat).

Fraud prevention and credit risk. We process personal information to prevent and detect fraud and abuse in order to protect the security of our customers.

Purposes for which we seek your consent. We may also ask for your consent to process your personal information for a specific purpose that we communicate to you. You may withdraw your consent at any time and we will cease processing your data for that purpose. Where processing is necessary for another lawful purpose, we may continue to process it on that basis.

Categories of persons to whom we disclose users’ personal data

Information about our customers is an important part of our business and we do not sell it to third parties. “Pakyov” Ltd. may share customers’ personal information only as described below, and only with third parties that maintain practices at least as protective as those described in this Privacy Policy.

“Pakyov” Ltd. may share personal information with data processors — persons who process personal data on behalf of and under the instruction of “Pakyov” Ltd., pursuant to a written agreement. They may not process the personal data provided to them for purposes other than carrying out the work assigned to them. Examples of such processors include:

Courier service providers;
Providers of information system implementation and/or maintenance services;
Law firms, accounting firms or other providers of advisory services;
Hosting service providers.

“Pakyov” Ltd. may share personal information with banks and payment institutions in connection with processing payments made by bank transfer or through a payment institution.

In the event of a transformation of “Pakyov” Ltd. or a transfer of assets in accordance with applicable law, users’ personal data administered by “Pakyov” Ltd. may be provided to a third-party successor.

Where legally required, personal data processed by “Pakyov” Ltd. will be disclosed to the competent authorities in accordance with the legislation of the Republic of Bulgaria.

How we protect your personal information

We work hard to protect the security of your information during transmission by using a Secure Sockets Layer (SSL) certificate, which encrypts the information you enter.

We maintain physical, electronic and procedural safeguards in connection with the collection, storage and disclosure of your personal data. Our security procedures mean that we may occasionally ask for proof of identity before disclosing personal information to you.

It is important that you protect yourself against unauthorised access to your password and to your computers and devices. Remember to sign out of your account when you have finished using a shared computer.

How long we retain your personal data

We retain users’ personal data for as long as is necessary to fulfil the purposes set out in this Privacy Policy or to comply with legal requirements.

In order to fulfil our obligations under tax and accounting legislation, data relating to a given user is retained for a period of 11 years from the termination of their last contract, provided the user has no outstanding obligations to “Pakyov” Ltd.

Once the retention period has expired, data is anonymised or erased/destroyed, unless:

it is required for pending judicial, arbitration, administrative or enforcement proceedings, or in connection with a complaint submitted by the relevant user; or
the relevant user has exercised their right to request restriction of the processing of their personal data.

General information about the rights of individuals

“Pakyov” Ltd. will act on a request by an individual to exercise a right under this section only if it is able to identify the person concerned.

“Pakyov” Ltd. will inform individuals of the action taken on their request within one month of receipt. Where necessary, this period may be extended by a further two months, and the individual will be informed of the reasons for the delay.

Where a request is refused, “Pakyov” Ltd. will inform the individual of their rights, including the right to lodge a complaint with the Commission for Personal Data Protection and to seek judicial remedy.

In certain cases, “Pakyov” Ltd. may request additional information to confirm the identity of the person submitting a request.

Actions taken in response to requests are entirely free of charge, unless requests are manifestly unfounded or excessive. In such cases, “Pakyov” Ltd. reserves the right, at its discretion, to: (a) refuse to act on the request; or (b) charge a reasonable fee based on the administrative costs of providing the requested information or taking the requested action.

Right of access to personal data

Users have the right to obtain from “Pakyov” Ltd. confirmation as to whether personal data relating to them is being processed, and if so, to obtain access to that data.

Rectification of inaccurate or outdated personal data

Where personal data processed by “Pakyov” Ltd. is inaccurate or outdated, users have the right to request its rectification.

Erasure of personal data (“Right to be forgotten”)

Users have the right to request erasure of their personal data in the following cases:

the personal data is no longer necessary for the purposes for which it was collected or processed;
the user has withdrawn their consent and there is no other legal basis for processing;
the user has objected to processing based on legitimate interests and there are no overriding legitimate grounds;
the user has objected to processing for direct marketing purposes;
the personal data has been processed unlawfully;
the personal data must be erased to comply with a legal obligation under national or European Union law.

Restriction of processing of personal data

Users have the right to request restriction of the processing of their personal data in the following cases:

the accuracy of the personal data is contested by the user, for a period enabling “Pakyov” Ltd. to verify its accuracy;
the processing is unlawful but the user does not wish the data to be erased and instead requests restriction of its use;
“Pakyov” Ltd. no longer needs the personal data for processing purposes but the user requires it for the establishment, exercise or defence of legal claims;
the user has objected to processing based on legitimate interests, pending verification of whether the legitimate grounds of “Pakyov” Ltd. override those of the user.

Portability of personal data

Users have the right to receive from “Pakyov” Ltd. the personal data they have provided, in a structured, commonly used and machine-readable format, and to transmit that data to another controller without hindrance, where:

“Pakyov” Ltd. processes the data for the purposes of performing a contract with the user or on the basis of the user’s consent; and
the processing is carried out by automated means.

Users may also request that “Pakyov” Ltd. transfer their personal data directly to another controller where technically feasible.

Right to object to the processing of personal data

Users have the right, at any time and on grounds relating to their particular situation, to object to the processing of their personal data where “Pakyov” Ltd. processes it on the basis of its legitimate interests. Where personal data is processed for direct marketing purposes, “Pakyov” Ltd. will always cease processing upon objection.

In all other cases, “Pakyov” Ltd. will carry out an internal review and will either: (a) notify the user that it will cease processing their personal data; or (b) provide reasoned grounds for continuing to process the data where a legal basis exists for doing so.

You may exercise your rights of access, rectification, erasure, restriction of processing and data portability by contacting us at mail@pakyov.com.

Right to lodge a complaint with a supervisory authority

Users have the right to lodge complaints or reports with the Commission for Personal Data Protection (CPDP) if they consider that “Pakyov” Ltd. is in breach of personal data protection legislation. Instructions for lodging complaints are published on the CPDP website: https://www.cpdp.bg.

Users may also lodge complaints with other supervisory authorities within the European Union in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation — “GDPR”).