.png)
PRIVACY POLICY
MANDATORY INFORMATION ON DATA SUBJECTS’ PERSONAL DATA PROTECTION RIGHTS
Information about the company processing your data
Name: BRIGHT STOCK LTD.
UIC/BULSTAT: 205545323
Registered office and management address: BULGARIA, Sofia, Slatina District, 3 Sirak Skitnik St., Floor 4
Correspondence address: Sofia, 10 Bilyanini Izvori St.
Telephone: 0889 013 157
E-mail: office@brightstock.eu
Website: www.brightstock.eu
Information about the competent personal data protection supervisory authority
Name: Commission for Personal Data Protection
Registered office and management address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592
Correspondence address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592
Telephone: 02 915 3 518
Website: www.cpdp.bg
BRIGHT STOCK LTD. (hereinafter referred to as the “Controller” or the “Company”) carries out its activities in accordance with the Personal Data Protection Act and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
The purpose of this information is to inform you about all aspects of the processing of your personal data by the Company and the rights you have in relation to such processing.
Grounds for the collection, processing and storage of your personal data
Art. 1. The Controller collects and processes your personal data in connection with the use of the online store www.brightstock.eu and the conclusion of contracts with the Company on the basis of Art. 6(1) of Regulation (EU) 2016/679 (GDPR), and more specifically on the following grounds:
Explicit consent obtained from you as a customer;
Performance of the Controller's obligations under a contract with you;
Compliance with a legal obligation applicable to the Controller;
For the purposes of the legitimate interests pursued by the Controller or by a third party.
Purposes and principles of collecting, processing and storing your personal data
Art. 2.
(1) We collect and process the personal data that you provide to us in connection with the use of the Online Store and the conclusion of a contract with the Company, including for the following purposes:
Creating an account and providing full functionality when using the Online Store;
Conclusion and performance of a distance contract;
Identification of a party to the contract;
Accounting purposes;
Statistical purposes;
Protection of information security;
Ensuring performance of the contract for provision of the respective service;
Sending newsletters where you have expressed a wish to receive them.
(2) We comply with the following principles when processing your personal data:
Lawfulness, fairness and transparency;
Limitation of processing purposes;
Relevance to the purposes of processing and minimisation of the data collected;
Accuracy and keeping data up to date;
Limitation of storage with regard to achievement of the purposes;
Integrity and confidentiality of processing and ensuring an appropriate level of security for personal data.
(3) When processing and storing personal data, the Controller may process and store personal data for the purpose of protecting the following legitimate interests:
Performance of its obligations to the National Revenue Agency, Ministry of Interior and other state and municipal authorities.
What types of personal data our Company collects, processes and stores
Art. 3.
(1) The Company performs the following operations with the personal data provided by you for the following purposes:
Registration of a user in the Online Store and performance of a distance purchase and sale contract
The purpose of this operation is to create an account for using the Online Store to purchase goods and to provide contact details for delivery of purchased goods.
Registration and creation of an account for use of the Online Store is not a mandatory step for provision of the service, and the service is to a significant extent also available without creation of an account.
Impact assessment conclusion: Based on the impact assessment carried out, the operation “Registration of a user in the Online Store and performance of a distance purchase and sale contract” is permissible and provides sufficient safeguards for protection of the rights and legitimate interests of data subjects in accordance with GDPR requirements.
Conclusion and performance of a commercial transaction with a customer or partner
The purpose of this operation is the conclusion and performance of a contract with a business partner or customer and the administration thereof.
Given the limited scope of personal data collected and the fact that some of it is collected from publicly available sources, carrying out a data protection impact assessment is not necessary for this operation.
Sending newsletters
The purpose of this operation is to administer the process of sending newsletters to customers who have indicated that they wish to receive them.
Given the limited scope of personal data collected, carrying out a data protection impact assessment is not necessary for this operation.
Exercising the right of withdrawal or submitting a complaint
The purpose of this operation is to administer the process of exercising the right of withdrawal or submitting a complaint by the customer.
Given the limited scope of personal data collected, carrying out a data protection impact assessment is not necessary for this operation.
(2) The Controller processes the following categories of personal data and information for the following purposes and on the following grounds:
Your identification data (email, name, etc.)
Purpose for which the data is collected:
Establishing contact with the User and sending information to them;
Registration of a User in the Online Store;
Sending newsletters.
Legal basis for processing your personal data:
By accepting the General Terms and Conditions and registering in the Online Store, placing an order without registration, or entering into a written contract, a contractual relationship is established between the Controller and you, on the basis of which we process your personal data pursuant to Art. 6(1)(b) GDPR.
Your data used for sending newsletters is processed on the basis of your explicit consent pursuant to Art. 6(1)(a) GDPR.
Delivery data (names, telephone number, address, etc.)
Purpose for which the data is collected: Performance of the Controller's obligations under a purchase and sale agreement and delivery of purchased goods.
Legal basis for processing your personal data:
By accepting the General Terms and Conditions and registering in the Online Store, placing an order without registration, or entering into a written contract, a contractual relationship is established between the Controller and you, on the basis of which we process your personal data pursuant to Art. 6(1)(b) GDPR.
Additional data provided by you
If you wish to supplement your profile, you may enter additional information such as first name, surname and telephone number.
Purpose for which the data is collected: Supplementing information about the User in their user account.
Legal basis for processing: You have provided explicit consent to the processing of your personal data for one or more specific purposes pursuant to Art. 6(1)(a) GDPR at the time of registration in the Online Store.
Providing this information is not mandatory for registration in the Online Store.
(3) The Controller does not collect or process personal data that:
Reveals racial or ethnic origin;
Reveals political, religious or philosophical beliefs or trade union membership;
Includes genetic and biometric data, health data or data concerning sex life or sexual orientation.
(4) The personal data is collected by the Controller directly from the persons to whom it relates.
(5) The Company does not perform automated decision-making using personal data.
Art. 4.
(1) The Company performs the following operations with personal data provided by you in your capacity as legal representatives or authorised representatives of legal entities that are business partners:
Conclusion and performance of a commercial transaction
For the conclusion and performance of a commercial transaction with a company, we process only the full names of the legal representative or the person authorised by the company.
Impact assessment conclusion: Given the relatively small number of natural persons whose data is processed and the limited amount of personal data collected, a data protection impact assessment is not required for this operation.
(2) The personal data is collected by the Controller from the persons to whom it relates and from the Commercial Register maintained by the Registry Agency.
(3) The Company does not perform automated decision-making using personal data.
Art. 5. The Controller may use so-called “cookies” for the purposes of providing full website functionality, improving user experience, statistical purposes, easier access and other similar purposes, to which you agree by using our website.
You may control and/or delete cookies at any time through the settings of the browser you use.
Cookies do not constitute personal data and are not used to identify visitors and users of the Online Store.
Retention period for your personal data
Art. 6.
(1) The Controller shall store your personal data for no longer than the period during which your Online Store account exists.
After deletion of your account, the Controller shall take the necessary measures to delete and destroy all your data without undue delay or anonymise it, i.e. convert it into a form that does not disclose your identity.
(2) The Controller shall process the personal data that you have provided when placing an order without registration in the Online Store until completion of the order, unless you have explicitly consented during the ordering process to your data being processed for the purposes of improving the service, providing recommended content, individual terms, promotions and statistical purposes.
(3) The Controller shall retain your personal data provided in connection with Online Store orders for a period of 5 years for the purpose of protecting the Controller's legal interests in judicial or administrative disputes with users of the Online Store.
(4) The Controller shall notify you if the data retention period needs to be extended for the purpose of compliance with a legal obligation, protection of legitimate interests of the Controller or for another applicable reason.
(5) The Controller shall retain personal data which it is required to keep under applicable legislation for the legally prescribed period, which may exceed the period during which your Online Store account exists or the period until completion of the order.
Art. 7. The Controller shall store the personal data of legal representatives of its business partners for the duration of performance of the relevant contract and for the purpose of protecting the Controller's legitimate interests and complying with its legal obligations.
Such period may exceed the term of the relevant contract.
Transfer of your personal data for processing
Art. 8.
(1) At its discretion, the Controller may transfer part or all of your personal data to data processors for the purpose of carrying out the processing activities to which you have agreed, subject to compliance with the requirements of Regulation (EU) 2016/679 (GDPR).
(2) The Controller shall inform you if it intends to transfer part or all of your personal data to third countries or international organisations.
Your rights regarding the collection, processing and storage of your personal data
Withdrawal of consent to the processing of your personal data
Art. 9.
(1) If you do not wish the personal data you have provided to be processed for marketing purposes or for receiving newsletters, you may withdraw your consent at any time by completing the consent withdrawal form in Appendix No. 1 or by sending us a free-form request by email.
(2) After receiving your request, we will send an email to the address you provided for receiving newsletters and advertising messages containing detailed instructions for verification of your identity as a newsletter recipient and as the data subject whose consent is being withdrawn.
(3) Withdrawal of consent shall not affect the lawfulness of processing carried out by the Controller prior to such withdrawal.
Right of access
Art. 10.
(1) You have the right to request and receive confirmation from the Controller as to whether personal data relating to you is being processed by sending a free-form request by email.
(2) You have the right to obtain access to the data relating to you, as well as information regarding the collection, processing and storage of your personal data.
(3) After receiving your request, we will send an email to the address you used for registration or placing orders in the Online Store containing detailed instructions for verification of your identity as the data subject whose personal data is subject to the access request.
(4) Following verification under paragraph 3, the Controller shall provide you, upon request, with a copy of the personal data being processed concerning you, in electronic or another appropriate format.
(5) Access to the data shall be provided free of charge, but the Controller reserves the right to impose an administrative fee in the event of repetitive or excessive requests.
Right to rectification or completion
Art. 11.
(1) You may at any time correct or supplement inaccurate or incomplete personal data relating to you through the “Edit Profile” option.
(2) You may correct or supplement inaccurate or incomplete personal data relating to you directly through your profile on the website or by submitting a request to the Controller by email using the form in Appendix No. 4 or by sending a free-form request.
Right to erasure (“right to be forgotten”)
Art. 12.
(1) You have the right to request that the Controller erase part or all of the personal data relating to you, and the Controller shall be obliged to erase such data without undue delay where one of the following grounds applies:
The personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
You withdraw the consent on which the processing is based and there is no other legal ground for the processing;
You object to the processing of personal data relating to you, including for direct marketing purposes, and there are no overriding legitimate grounds for the processing;
The personal data has been unlawfully processed;
The personal data must be erased for compliance with a legal obligation under EU law or Member State law applicable to the Controller;
The personal data has been collected in connection with the offer of information society services.
(2) The Controller shall not be obliged to erase personal data where such data is stored and processed:
For exercising the right of freedom of expression and information;
For compliance with a legal obligation requiring processing under EU or Member State law applicable to the Controller, or for performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller;
For reasons of public interest in the area of public health;
For archiving purposes in the public interest, scientific or historical research purposes or statistical purposes;
For establishment, exercise or defence of legal claims.
(3) To exercise your right to be forgotten, you must send by email a request for erasure of the personal data processed by the Controller by completing the form in Appendix No. 2 or by sending a free-form request.
The Controller will then send an email to the address used by you for registration or placing orders in the Online Store containing detailed instructions for verification of your identity as a User of the Online Store and as the data subject whose personal data is subject to the erasure request.
(4) After verifying that the person submitting the request is the same person to whom the relevant data relates, in accordance with the instructions sent to you, we shall erase all data processed about you in accordance with paragraph 3.
(5) If you have an order currently being processed, the earliest point at which you may request to be “forgotten” shall be after successful completion of the order.
Right to restriction of processing
Art. 13.
(1) You have the right to request that the Controller restrict processing of data relating to you by sending us a free-form request by email where:
You contest the accuracy of the personal data, for a period enabling the Controller to verify the accuracy of the personal data;
The processing is unlawful but you do not wish the personal data to be erased and instead request restriction of its use;
The Controller no longer needs the personal data for the purposes of processing, but you require it for establishment, exercise or defence of legal claims;
You have objected to processing pending verification as to whether the legitimate grounds of the Controller override your interests.
(2) After receiving your request, we shall send an email to the address used by you for registration or placing orders in the Online Store containing detailed instructions for verification of your identity as a User of the Online Store and as the data subject whose personal data is subject to the request for restriction of processing.
(3) Following verification under paragraph 2, the Company shall cease processing your data but shall not remove any publications made by you in the Online Store, if any.
Right to data portability
Art. 14.
(1) If you have consented to processing of your personal data, or processing is necessary for performance of the contract with the Controller, or your data is processed by automated means, you may:
Request that the Controller provide your personal data in a readable format so that you may transfer it to another controller;
Request that the Controller directly transfer your personal data to a controller designated by you, where technically feasible.
(2) You may exercise your right to data portability by sending us by email the completed form under Appendix No. 3 or a free-form request.
The Controller will then send an email to the address used by you for registration or placing orders in the Online Store containing detailed instructions for verification of your identity as a User of the Online Store and as the data subject whose personal data is subject to the portability request.
(3) Following verification under paragraph 2, the Company shall send the data it processes about you to the email address specified by you in XML format.
Right to receive information
Art. 15. You may request that the Controller inform you of all recipients to whom the personal data subject to a request for rectification, erasure or restriction of processing has been disclosed.
The Controller may refuse to provide this information where doing so would be impossible or would involve disproportionate effort.
Right to object
Art. 16. You may object at any time to the processing by the Controller of personal data relating to you, including where such data is processed for profiling or direct marketing purposes.
Your rights in the event of a personal data security breach
Art. 17.
(1) Where the Controller establishes a breach of the security of your personal data which is likely to result in a high risk to your rights and freedoms, the Controller shall inform you of the breach without undue delay, as well as of the measures taken or proposed to be taken.
(2) The Controller shall not be required to notify you if:
It has implemented appropriate technical and organisational protection measures in relation to the data affected by the breach;
It has subsequently taken measures ensuring that the breach is no longer likely to result in a high risk to your rights;
Notification would involve disproportionate effort.
Persons to whom your personal data is disclosed
Art. 18.
(1) For the purposes of processing your personal data and providing the service in its full functionality and in consideration of your interests, the Controller may disclose your data to the following persons acting as data processors:
Data Processor
Purpose of Personal Data Processing
...............................................
.....................................................................
...............................................
.....................................................................
...............................................
.....................................................................
(2) Data processors shall comply with all legal and security requirements relating to the processing and storage of your personal data.
Art. 19. The Controller does not transfer your data to third countries.
Art. 20. In the event of a violation of your rights under the above provisions or under applicable personal data protection legislation, you have the right to lodge a complaint with the Commission for Personal Data Protection as follows:
Name: Commission for Personal Data Protection
Registered office and management address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592
Correspondence address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592
Telephone: 02 915 3 518
Website: www.cpdp.bg
Art. 21. You may exercise all of your personal data protection rights using the forms attached to this information.
These forms are not mandatory, and you may submit your requests in any form containing a statement of your request and allowing you to be identified as the data subject.
Art. 22. Where consent relates to a data transfer, the Controller shall describe the possible risks of transferring data to third countries in the absence of an adequacy decision and appropriate safeguards.
APPENDIX No. 1
Form for Withdrawal of Consent for Processing Purposes
Your name*: ....................................
Your email used in the Online Store*: ....................................
Contact details (email)*: ....................................
To:
Name: Bright Stock Ltd.
UIC/BULSTAT: 205545323
Registered office and management address: Sofia, Slatina District, 3 Sirak Skitnik St., Floor 4
Correspondence address: Sofia, 10 Bilyanini Izvori St.
Telephone: 0889 013 157
E-mail: www.brightstock.eu">office@www.brightstock.eu
Website: www.brightstock.eu
I hereby withdraw my consent to the processing of the personal data provided by me for the purposes of receiving newsletters, advertising messages or other marketing materials.
I confirm that I am familiar with the conditions for withdrawal of consent in accordance with the Mandatory Information on Data Subjects’ Personal Data Protection Rights applicable to the Online Store.
In the event of a violation of your rights under the above provisions or applicable personal data protection legislation, you have the right to lodge a complaint with the Commission for Personal Data Protection as follows:
Name: Commission for Personal Data Protection
Registered office and management address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592
Correspondence address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592
Telephone: 02 915 3 518
Website: www.cpdp.bg
APPENDIX No. 2
Request to “Be Forgotten” – Request for Erasure of Personal Data Relating to Me
Your name*: ....................................
Your email used for registration or orders in the Online Store*: ....................................
Contact details (email)*: ....................................
To:
Name: Bright Stock Ltd.
UIC/BULSTAT: 205545323
Registered office and management address: Sofia, Slatina District, 3 Sirak Skitnik St., Floor 4
Correspondence address: Sofia, 10 Bilyanini Izvori St.
Telephone: 0889 013 157
E-mail: www.brightstock.eu">office@www.brightstock.eu
Website: www.brightstock.eu
I hereby request that all personal data collected, processed and stored by you, provided by me or by third parties and relating to me according to the identification information provided, be erased from your databases.
I declare that I am aware that part or all of my personal data may continue to be processed and stored by the Controller for the purposes of complying with its legal obligations.
In the event of a violation of your rights under the above provisions or applicable personal data protection legislation, you have the right to lodge a complaint with the Commission for Personal Data Protection as follows:
Name: Commission for Personal Data Protection
Registered office and management address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592
Correspondence address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592
Telephone: 02 915 3 518
Website: www.cpdp.bg
APPENDIX No. 3
Request for Personal Data Portability
Your name*: ....................................
Your email used for registration or orders in the Online Store*: ....................................
Contact details (email)*: ....................................
To:
Name: Bright Stock Ltd.
UIC/BULSTAT: 205545323
Registered office and management address: Sofia, Slatina District, 3 Sirak Skitnik St., Floor 4
Correspondence address: Sofia, 10 Bilyanini Izvori St.
Telephone: 0889 013 157
E-mail: www.brightstock.eu">office@www.brightstock.eu
Website: www.brightstock.eu
I hereby request that all personal data relating to me that is collected, processed and stored in your databases be sent in XML format to:
E-mail: ....................................
Controller receiving the data: ....................................
Name: ....................................
Identification number (UIC, BULSTAT, registration number with the Commission for Personal Data Protection): ....................................
E-mail: ....................................
In the event of a violation of your rights under the above provisions or applicable personal data protection legislation, you have the right to lodge a complaint with the Commission for Personal Data Protection as follows:
Name: Commission for Personal Data Protection
Registered office and management address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592
Correspondence address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592
Telephone: 02 915 3 518
Website: www.cpdp.bg
APPENDIX No. 4
Request for Rectification of Data
Your name*: ....................................
Your email used for registration or orders in the Online Store*: ....................................
Contact details (email)*: ....................................
To:
Name: Bright Stock Ltd.
UIC/BULSTAT: 205545323
Registered office and management address: Sofia, Slatina District, 3 Sirak Skitnik St., Floor 4
Correspondence address: Sofia, 10 Bilyanini Izvori St.
Telephone: 0889 013 157
E-mail: www.brightstock.eu">office@www.brightstock.eu
Website: www.brightstock.eu
I hereby request that the following personal data collected, processed and stored by you, provided by me or by third parties and relating to me, be rectified as follows:
Data to be corrected:
..................................................
Please correct the data as follows:
..................................................
In the event of a violation of your rights under the above provisions or applicable personal data protection legislation, you have the right to lodge a complaint with the Commission for Personal Data Protection as follows:
Name: Commission for Personal Data Protection
Registered office and management address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592
Correspondence address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592
Telephone: 02 915 3 518
Website: www.cpdp.bg