The protection of personal data and the protection of the personal and financial information of our customers is particularly important to us. In this regard, this Security Policy is intended to disclose what personal data we collect about you through our joint relationship and how we use that data.
We process your information exclusively on the basis of the applicable legislation, specifically the General Regulation 2016/670 (“Regulation”), better known as GDPR, the Personal Data Protection Act (ЗЗЛД) and the Electronic Commerce Act ( BROTHER-IN-LAW).
In order to conclude and execute the contract for distance sales and delivery of the ordered goods through the website hestiascent.com. ("Site"), "V END V GROUP" EOOD ("We"), EIC: 205003098 with registered office and management address: Plovdiv, Osvobozhdenie Blvd. 59, processes data of natural persons ("Data Subjects "/"You"/"You"), in accordance with this Policy.
According to the Regulation, personal data is any information that relates to you and by which you can be identified or have already been identified.
I. CATEGORIES OF ENTITIES WHOSE PERSONAL DATA WE PROCESS
In connection with providing the Services on the Site and concluding and executing contracts, WE process information about the following Data Subjects:
- natural persons, users of the Site without registration.
- natural persons, users of the Site with registration.
- natural persons who sent inquiries (including by calling), requests, signals or other correspondence to "V END V GROUP" EOOD.
- natural persons, information about which is contained in inquiries (including by calling), requests, signals or other correspondence sent to "Isen Management" EOOD.
- natural persons with whom We conclude contracts - our employees, customers, partners, etc.
II. PERSONAL DATA WE PROCESS
It is impossible for us to provide the Services on the Site and to enter into and perform a contract with you if you do not provide us with information. In this regard, we require certain information from you. You decide whether and how to use the Services provided through the Site. In the forms through which personal data is entered, we clearly indicate the mandatory or voluntary nature of providing the data. The data, the filling of which is mandatory, are those without which it is impossible to conclude and execute the relevant contract. These are:
- three names;
- mailing address;
- e-mail address;
- phone;
- shipping address;
- ZIP code;
- The IP address from which the order was placed.
Our site allows you to subscribe and receive notifications about new or current products, incl. promotions. You need to provide an email address where you wish to receive the subscription. The subscription can be terminated at any time through the functionality created for this purpose in your profile or by making a request through the contact form with Us.
The functionalities provided on the Site are not intended for storage and processing of special categories of data within the meaning of Art. 9 and Art. 10 of the General Data Protection Regulation.
"V END V GROUP" EOOD may also process other data relating to you, in cases where you voluntarily provide such data by filling in the relevant electronic form on the Site, giving your consent to this, or you add preferences, settings and etc.
In addition, We collect information from your computer, phone, tablet or other device that you use to visit the Site. This information may include your IP address, the browser you use, and your language, date, and time settings. There are also situations where we receive information from our other partners or automatically collect other information.
The Site uses logs for the following purposes:
• To ensure the reliable functioning of the Services and to identify technical problems.
• To ensure the security of the Services and detect malicious actions.
• To develop and improve the Services on the Site.
• To measure the attendance of the Site.
We may also use server logs, logs of security protection devices (Web Application Firewalls), etc. devices falling into this category. These logs are necessary to diagnose technical problems, detect malicious actions, etc. of the above objectives. Logs may contain the following information: date and time, IP address, URL, browser and device information. In addition, some of the devices may use cookie-based security technology.
III. FOR WHAT PURPOSES DO WE PROCESS YOUR PERSONAL DATA
Generally speaking, we process your personal data for the purpose of providing the Services indicated on the Site, including the conclusion and execution of the contract for distance sales and delivery of the ordered goods through the hestiascent.com site. We also use your personal data to contact you, and at your request, to inform you about our latest offers and special offers, as well as other products and services that we think will be of interest to you.
V END V GROUP ” EOOD processes the information described above for the purposes provided for in this Policy, which may be related to:
• conclusion of contracts between you and "V END V GROUP" EOOD.
• performance of such contracts, including processing your order, noting that we may retain your data for a reasonable period of time after you have completed the transaction in order to fulfill any contractual obligations such as refunds, warranties, etc. ., and to comply with all legal obligations to retain transaction data.
• providing the services of the Site.
• protection and enforcement of the legitimate interests of other users of the Site's services, third parties and "V END V GRUP t" EOOD.
• fulfillment of legal obligations of "V END V GROUP" EOOD.
• informing you about our new offers and special offers about which you want us to send you information by e-mail, post, mobile phone and/or through other digital means, including through social media platforms.
• your registration on the Website, in which case We will also use your personal information to maintain and update your profile.
• administration of all raffles, contests, contests held by "V END V GROUP" EOOD.
• the administration of the website.
• analyzing and improving the use of our website.
• measuring and analyzing our advertising.
• keeping our website and network secure and safe.
• processing payments and preventing fraudulent transactions, and we may pass your data to a third party to perform these functions.
Our legitimate interest in the processing of your personal data arises from the need to ensure the protection and protection of the legal interests of "V END V GRUP" EOOD and/or third parties, which is related to:
• ensuring the normal use of the Site by you and other users, resolution of disputes, detection and prevention of malicious actions.
• detection and resolution of technical or functionality problems, development and improvement of the purpose of the Site.
• communicating with you, including electronically, on important issues related to the Services provided on the Site and/or the performance of concluded contracts.
• receiving and processing received inquiries, requests, complaints and other correspondence;
• implementation and protection of the rights and legal interests of "V END V GROUP" EOOD, including by court order, and providing assistance in the implementation and protection of the rights and legal interests of other users of the site and/or affected third parties.
For these purposes, it may be necessary to process some or all of the above categories.
Our legal obligations include the fulfillment of obligations provided for by law to preserve or provide information upon receipt of a relevant order from competent state or judicial authorities, when providing an opportunity to exercise the control powers of the competent state authorities, when fulfilling obligations provided for in the General Regulation regarding data protection, related to notifying you of various circumstances related to your rights, the Services provided or the protection of your data, etc. similar. For these purposes, it may be necessary to process some or all of the above categories.
Your data may be processed on the basis of your express consent, and the processing in this case is specific and to the extent and scope provided for in the relevant consent.
We process anonymized data for static purposes, that is, for analyzes where the results are only generalizable and therefore the data is anonymous – for example, to represent the movement of large groups of people. Identification of a specific person from this information is impossible.
IV. HOW LONG WE KEEP YOUR PERSONAL DATA
When storing data, WE apply the general principle of storing data in a minimum volume and for a period no longer than is necessary to provide the Services (implementation of the contracts) otherwise, ensuring their security and reliability and the requirements of the law.
| Data types | Storage period | Explanation |
| Registration data (such as three names, correspondence address, email address, telephone, address, postal code) and information about the registration and acceptance of the Terms (date, time, IP address) | For the entire period of maintaining your profile on the Site and up to 1 /one/ year from termination of registration | The data identifies you as a specific user on the Site. |
| Data in case of concluded contract (name, e-mail address and postal address) | Until your registration is terminated or until we fulfill all legal and contractual obligations. | When making a purchase through our website, we will retain said information for the purpose of reporting new and existing users to our partner advertisers. We retain transaction information for as long as required by law. We will retain information about your web browser history for a similar period. |
| Your email address for notification of new or updated products | For the period for which the subscription is active, until its termination. | The site allows you to subscribe and receive notifications about new or updated products to your email address. The subscription can be terminated at any time by sending a request to this effect through the contact form with Us. |
| Setting | Until they are deleted by you or until your registration is terminated. In case they are stored in a biscuit, up to 6 /six/ months from the last use | This category includes settings such as language selection, etc. under. |
| System logs (may contain information such as: date and time, IP address, URL, browser version and device information) | For a period of up to 1 /one/ year | Server logs, logs of security protection devices (Web Application Firewalls), etc. devices falling into this category. These logs are necessary to identify technical issues and/or detect malicious activity. |
| Inquiries, requests and any correspondence, incl. incoming phone calls. | Correspondence is stored for a period of up to 5 /five/ years. In order to ensure the reliability of the service, incoming telephone calls are stored for a period of up to 3 /three/ months. For registered users, this data is stored until registration is terminated, unless we deem it unnecessary. | In order to better communicate with you, We store and process the data received through electronic forms on the Site, through calls to the telephone exchange of "Isen Management" EOOD, by sending by regular or e-mail, as well as the result of this processing. |
| Biscuits | Up to 6 /six/ months from the last use of the Services | For a description of the cookies used, see "Policy on the use of cookies" |
In the event of a legal dispute or proceeding requiring the retention of data and/or a request from a competent state authority, it is possible to retain data for longer than the specified periods until the final conclusion of the arising dispute or proceeding before all instances. The stated terms may be changed in the event that a different requirement to retain the information is established under current legislation.
V. DO WE SHARE YOUR PERSONAL DATA WITH THIRD PARTIES
"Isen Management" EOOD does not provide your personal data to third parties, in any other way, except in the cases described in this Policy and provided by law. To provide the best conditions under the contracts with our partners, We provide your personal data to:
- our employees and professional advisors using special software providing controlled access to your data.
- forwarders, suppliers, business partners, in connection with the provision of the Services on the site and with the execution of the contracts concluded with you.
- competent government or judicial authority if duly requested.
- persons to whom we have your express consent to provide your personal data.
- third parties in order to protect the rights and legitimate interests of "Isen Management" EOOD and/or other users of the Site.
- our third-party advertisers.
- search engine and web analytics providers.
When working with the above-mentioned categories of persons to whom we provide your personal data, We require them to strictly follow our instructions, in accordance with this Policy and with the adopted internal rules.
You should be aware that if we are asked by the police or any other regulatory or government authority investigating suspected illegal activities to provide your personal information or other information we obtain about you, we have the right to do so.
Our website also contains links to and from third party websites - Facebook and Instagram. Note that they have their own privacy policies and that we take no responsibility for those policies. Please check these policies before submitting information to these websites.
VI. YOUR RIGHTS REGARDING PERSONAL DATA
According to the General Data Protection Regulation, you have the following rights, which you can exercise by sending an electronic message with an attached request to this effect through the contact form:
- Right to information.
This Policy aims to inform you in detail about the processing of your personal data in connection with the processing of your personal data.
- Right of access.
You have the right to receive confirmation as to whether your personal data is being processed, access to it and information about how it is being processed and your rights in this regard. You can inquire about your existing personal data and submit an application for their deletion.
- Right to rectification.
You have the right to correct and supplement your personal data if they are incomplete or inaccurate.
- Right to erasure (right to be forgotten).
You have the right to request deletion of data, except in cases where there is a substantial reason and/or legal obligation for their processing.
- Close registration.
If you wish, you have the possibility to close your registration at any time by submitting a request to this effect through the contact form.
After closing the account, all data, part of it, is deleted. In connection with our obligations, responsibilities and requirements of the law, your personal data is stored for the purpose of resolving possible disputes that arose or became known after closing your registration. The retention period for your personal data is set out in the "How long do we keep your information?" section.
- Right to restriction in relation to data processing.
The General Data Protection Regulation provides for the possibility to restrict the processing of your personal data if there are grounds for this provided for in it.
- Right to notify third parties.
If applicable, you have the right to request the Administrator of your personal data to notify the third parties, when he has provided your data, regarding the correction, deletion or restriction of the processing of your personal data.
- Right to data portability.
You have the right to receive the personal data concerning you that you have provided in a structured, widely used and machine-readable format and have the right to transfer this data to another controller without hindrance from us, in case the processing is based on consent or contractual obligation or the processing is carried out in an automated manner. The Site provides functionality that allows you to export the information you want.
Important: The responsibility for the storage of data exported from the Site, as well as for all the consequences of providing them to other administrators, is entirely yours.
- Right not to be subject to a decision based solely on automated processing, including profiling, which gives rise to legal consequences for you or similarly significantly affects you, unless there are grounds for this and appropriate guarantees are provided to protect your rights, freedoms and legitimate interests.
Technologies falling into this category are not used when providing the Services on the Site.
- Right to withdraw consent.
You have the right, at any time, to withdraw the consent you have given in connection with the processing of personal data on the basis of your consent. Such withdrawal does not affect the lawfulness of the processing based on the consent given until the time of its withdrawal.
- Right to object.
You have the right to object to data processed on the basis of legitimate interest.
In the event of such an objection, We will consider Your request and, if justified, We will comply with it. If we believe that there are compelling legal grounds for the processing or that it is necessary for the establishment, exercise or defense of legal claims, we will inform you of this.
- Right of appeal to a supervisory authority.
You have the right to lodge a complaint with the supervisory authority if you consider that the processing of personal data concerning you violates the applicable legislation on the protection of personal data. The supervisory authority in the Republic of Bulgaria is the Commission for the Protection of Personal Data with address: Sofia 1592, "Prof. Tsvetan Lazarov" No. 2.
In the event that you exercise these rights manifestly unfounded or excessively, in particular due to their repetition, V END V GROUP EOOD reserves the right to impose a reasonable fee, taking into account the administrative costs of providing the information or communication or taking the requested actions, or refuse to act on the request.
VII. ACCURACY OF INFORMATION
"V END V GROUP" EOOD is not responsible for the accuracy of the data provided by you, does not carry out checks in this sense and does not guarantee the actual identity of the individuals who provided the data. In all cases of doubt on your part, of established fraud and/or abuse, please notify us immediately. You undertake, when providing any information on the Site, not to violate the rights of other persons in connection with the protection of their personal data or their other rights.
VIII. HOW WE PROTECT YOUR PERSONAL DATA
The personal data that we have collected about you and that we process, reaches us in an encrypted form, and for this process we use an SSL (secure socket layer) encryption system. It is this system that ensures that your personal data is safe when your browser communicates with our server. Our website and the other systems we work with are protected using appropriate technical and organizational measures against the loss and destruction of your personal data, against access by external parties to your personal data and against their alteration or dissemination.
We periodically improve protection by also requiring our data processors to demonstrate compliance of the systems they use with the General Data Protection Regulation (GDPR).
If you register, access to your customer account is only possible after entering your chosen password. We do not have access to your password because we store it in an encrypted form that cannot be deciphered even by us.
Please note that you must not disclose your access data to third parties. After completing your activity in the customer account, we recommend that you log out of it, especially if you share the device with other users. We are not responsible for any misuse of your password, unless we have directly caused such a situation.