Personal Data Processing Policy
Data controller:
Nagrevatel BG Ltd, a company registered in the Commercial Register of the Registry Agency under UIC 205552809, with registered seat and address: 90 General Stoletov St, Stara Zagora, Bulgaria; phone: +359 889 222 015; e-mail: office@nagrevatel.bg.
We process your personal data on the following grounds:
- A contract concluded between you and us – to fulfil our obligations under it;
- Your explicit consent – the purpose is stated in each specific case;
- A legal obligation.
For the performance of a contract or pre-contractual relations
We process your data to perform our contractual and pre-contractual obligations and to exercise our rights under contracts concluded with you. Purposes: verifying your identity; managing and fulfilling your order and contract; issuing and sending invoices; keeping correspondence relating to orders, requests and problem reports; creating a user account.
On this ground we process: contact data (address, e-mail, phone number); identification data (full name, personal ID number, permanent address); order data from the user account; correspondence and information on requests, complaints and claims; bank/payment account details relating to payments made. Providing this data is mandatory in order for us to conclude and perform the contract with you.
We disclose personal data to the following categories of recipients: postal operators and courier companies; consultancy service providers. Data collected on this ground is deleted 5 years after the contractual relationship ends (the term reflects the 5-year limitation period for contractual claims).
For compliance with legal obligations
The law may require us to process your data – e.g. under the Anti-Money Laundering Measures Act; obligations under the Consumer Protection Act; providing information to the Consumer Protection Commission and the Personal Data Protection Commission; obligations under the Accountancy Act and the Tax and Social Insurance Procedure Code; providing information to the courts. Data collected by law is deleted once the obligation lapses – e.g. accounting data (11 years) and data for court/state proceedings (5 years).
On the basis of your consent
We process data on this ground only after your explicit, unambiguous and voluntary consent. Refusal will not result in any adverse consequences for you. The data usually includes: e-mail, phone, address and name. Consent may be withdrawn at any time, without affecting the performance of contractual obligations. Data collected on this ground is deleted upon your request or 1 year after it was first collected.
Processing of anonymised data
We process data for statistical purposes – analyses in which results are aggregated and anonymous. Identifying a specific individual from this information is not possible.
How we protect your personal data
To ensure adequate protection we apply all necessary organisational and technical measures required by the Personal Data Protection Act. For maximum security during processing, transfer and storage we may use additional protection mechanisms such as encryption and pseudonymisation.
Your rights
Every user enjoys the personal-data rights granted under Bulgarian law and EU law, including the right to: be informed; access their own personal data; rectification; erasure (“right to be forgotten”); restriction of processing; data portability; objection; judicial or administrative remedy; and the right not to be subject to a decision based solely on automated processing (profiling).
Complaint to the supervisory authority. Every user has the right to lodge a complaint against unlawful processing of their personal data with the Personal Data Protection Commission or the competent court.