Mandatory Information on the Rights of Data Subjects under Personal Data Protection Law
Information about the company that processes your data:
Name: Helmed Bulgaria EOOD
UIC/BULSTAT: 130477290
Registered office and address: Sofia 1309, Tsar Simeon St., Bl. 20
Correspondence address: Sofia 1309, Todor Alexandrov Blvd. 179, Bl. 79, ground floor
Telephone: +359879548300
E-mail: info@helmed.bg
Website: www.helmed.bg
Personal Data Administrator Identification Number: 280292
Information about the competent supervisory authority on personal data protection:
Name: Commission for Personal Data Protection
Registered office and address: Sofia 1592, "Prof. Tsvetan Lazarov" Blvd. No. 2
Correspondence address: Sofia 1592, "Prof. Tsvetan Lazarov" Blvd. No. 2
Telephone: 02 915 3 518
Website: www.cpdp.bg
Helmed Bulgaria EOOD (hereinafter for short the "Administrator" or the "Company") carries out its activities in accordance with the Personal Data Protection Act and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. The purpose of this information is to inform you about all aspects of the processing of your personal data by the Company and the rights you have in connection with this processing.
Legal basis for collecting, processing and storing your personal data
Art. 1. The Administrator collects and processes your personal data in connection with the use of the online store www.helmed.bg and the conclusion of contracts with the Company on the basis of Art. 6, para. 1 of Regulation (EU) 2016/679 (GDPR), and more specifically on the following grounds:
- Explicit consent received from you as a customer;
- Performance of the Administrator’s obligations under a contract with you;
- Compliance with a legal obligation applicable to the Administrator;
- For the purposes of the legitimate interests of the Administrator or a third party;
Purposes and principles in the collection, processing and storage of your personal data
Art. 2. (1) We collect and process the personal data that you provide in connection with the use of the online store and the conclusion of a contract with the Company, including for the following purposes:
- creating an account and providing full functionality when using the online store;
- concluding and performing a distance contract;
- identifying the party to the contract;
- accounting purposes;
- statistical purposes;
- protection of information security;
- ensuring the performance of the contract for the provision of the relevant service;
- sending a newsletter where you have expressed a wish to receive it;
(2) We observe the following principles when processing your personal data:
- lawfulness, fairness and transparency;
- purpose limitation;
- data minimisation and relevance to the purposes of the processing;
- accuracy and keeping data up to date;
- storage limitation with regard to achieving the purposes;
- integrity and confidentiality, ensuring an appropriate level of security of personal data.
(3) In the processing and storage of personal data, the Administrator may process and store personal data for the purpose of protecting its following legitimate interests:
- performance of its obligations to the National Revenue Agency, the Ministry of Interior and other state and municipal authorities.
Types of personal data that our company collects, processes and stores
Art. 3. (1) The Company performs the following operations with the personal data you provide for the following purposes:
- Registration of a user in the online store and performance of a distance sales contract – the purpose of this operation is to create a profile for using the online store to purchase goods and to provide contact details for delivery of purchased goods. Registration and creation of a profile for using the online store are not a mandatory step for using the service, and the store is largely accessible without creating a profile.
Conclusion from the impact assessment: On the basis of the impact assessment carried out, the operation "Registration of a user in the online store and performance of a distance sales contract" is admissible and provides sufficient safeguards for the protection of the rights and legitimate interests of data subjects in accordance with the requirements of the GDPR. - Concluding and performing a commercial transaction with a customer or partner – the purpose of this operation is to conclude and perform a contract with a commercial partner or customer and its administration. Given the limited scope of the personal data collected and the fact that part of it is collected from publicly accessible sources, it is not necessary to carry out an impact assessment for this operation.
- Sending a newsletter – the purpose of this operation is to administer the process of sending newsletters to customers who have indicated that they wish to receive them. Given the limited scope of the personal data collected, it is not necessary to carry out an impact assessment for this operation.
- Exercising the right of withdrawal or filing a complaint – the purpose of this operation is to administer the process of exercising the right of withdrawal or the filing of a complaint by the customer. Given the limited scope of the personal data collected, it is not necessary to carry out an impact assessment for this operation.
(2) The Administrator processes the following categories of personal data and information for the following purposes and on the following grounds:
- Your identifying data (e-mail, name, etc.)
- Purpose for which the data are collected: (1) to establish contact with the user and send information, (2) for user registration in the online store, and (3) for sending newsletters.
- Legal basis for processing your personal data: by accepting the General Terms and Conditions and registering in the online store or placing an order without registration, or by concluding a written contract, a contractual relationship is established between the Administrator and you, on which basis we process your personal data – Art. 6, para. 1, letter (b) of the GDPR. Your data for sending a newsletter are processed on the basis of your explicit consent – Art. 6, para. 1, letter (a) of the GDPR.
- Data for carrying out a delivery (names, telephone, address, etc.)
- Purpose for which the data are collected: performance of the Administrator's obligations under a sales contract and delivery of the purchased goods.
- Legal basis for processing your personal data: by accepting the General Terms and Conditions and registering in the online store or placing an order without registration, or by concluding a written contract, a contractual relationship is established between the Administrator and you, on which basis we process your personal data – Art. 6, para. 1, letter (b) of the GDPR.
- Additional data provided by you – If you wish to supplement your profile, you may fill in data such as first name, last name, phone number.
- Purpose for which the data are collected: supplementing user information in the user account.
- Legal basis for processing the data: you have given your explicit consent for the processing of your personal data for one or more specific purposes – Art. 6, para. 1, letter (a) of the GDPR at the moment of registration in the online store. Providing these data is not mandatory for registration.
(3) The Administrator does not collect and does not process personal data relating to:
- racial or ethnic origin;
- political, religious or philosophical beliefs, or trade union membership;
- genetic and biometric data, health data, or data concerning sex life or sexual orientation.
(4) The personal data are collected by the Administrator from the persons to whom they relate.
(5) The Company does not perform automated decision-making with data.
Art. 4. (1) The Company performs the following operations with the personal data provided by you in your capacity as legal representatives or authorised persons of legal entities – commercial partners, for the following purposes:
- Concluding and performing a commercial transaction: for the conclusion and performance of a commercial transaction with a commercial company, we process only the full name of the legal representative or the person authorised by the company. Conclusion from the impact assessment: given the small number of natural persons whose data are processed and the limited amount of personal data collected, it is not necessary to carry out an impact assessment for this operation.
(2) The personal data are collected by the Administrator from the persons to whom they relate and from the Commercial Register at the Registry Agency.
(3) The Company does not perform automated decision-making with data.
Art. 5. The Administrator may use so-called "cookies" in order to provide full functionality of the website, improve user experience, for statistical purposes, easier access, etc., which you agree to by using our website. You may control and/or delete cookies at any time through the settings of your browser. Cookies do not constitute personal data and are not used to identify visitors and users of the online store.
Retention period for your personal data
Art. 6. (1) The Administrator stores your personal data for no longer than the existence of your profile in the online store. After deleting your profile, the Administrator takes the necessary care to delete and destroy all your data without undue delay or to anonymise them (that is, to bring them into a form that does not reveal your identity).
(2) The Administrator processes your personal data provided when placing an order without registration in the online store until the order is completed, unless you have given your explicit consent when placing the order for your data to be processed for the purposes of improving the service, providing recommended content for you, individual terms, promotions, as well as for statistical purposes.
(3) The Administrator stores your personal data provided in connection with online orders for a period of 5 years for the purposes of protecting the Administrator’s legal interests in court or administrative disputes with users of the online store.
(4) The Administrator will notify you if the retention period needs to be extended in order to comply with a legal obligation or in view of the Administrator’s legitimate interests or other reasons.
(5) The Administrator stores the personal data that must be retained under applicable legislation for the period specified in that legislation, which may exceed the existence of your profile in the online store or the completion of the order.
Art. 7. The Administrator stores the personal data of the legal representatives of its commercial partners for the term of performance of the contract, for compliance with the Administrator’s legitimate interests and legal obligations, and this period may exceed the term of the contract.
Transfer of your personal data for processing
Art. 8. (1) The Administrator may, at its own discretion, transfer part or all of your personal data to personal data processors for the purposes of processing for which you have given your consent, subject to the requirements of Regulation (EU) 2016/679 (GDPR).
(2) The Administrator will notify you in case of intention to transfer part or all of your personal data to third countries or international organisations.
Your rights in the collection, processing and storage of your personal data
Withdrawal of consent to the processing of your personal data
Art. 9. (1) If you do not wish the personal data you have provided to be processed for marketing purposes and for receiving newsletters, you may withdraw your consent to processing at any time by completing the withdrawal form in Annex No. 1 or by sending a free-form request to us by e-mail.
(2) Once we receive your request, we will send an e-mail to the address you have provided for receiving newsletters and marketing communications, containing detailed instructions for verifying your identity as the recipient of newsletters and as the data subject whose consent is being withdrawn.
(3) Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal by the Administrator.
Right of access
Art. 10. (1) You have the right to request and receive from the Administrator confirmation as to whether personal data concerning you are being processed by sending a free-form request by e-mail.
(2) You have the right to access the data concerning you, as well as the information relating to the collection, processing and storage of your personal data.
(3) Once we receive your request, we will send an e-mail to the address you used for registration or for placing orders in the online store, containing detailed instructions for verifying your identity as the data subject whose access is requested.
(4) After the verification under para. 3 is carried out, the Administrator will provide you, upon request, with a copy of the personal data being processed concerning you, in electronic or other appropriate form.
(5) Providing access to the data is free of charge, but the Administrator reserves the right to impose an administrative fee in case of repetitive or excessive requests.
Right to rectification or completion
Art. 11. (1) You may at any time rectify or complete inaccurate or incomplete personal data concerning you via the "Edit profile" option.
(2) You may rectify or complete inaccurate or incomplete personal data concerning you directly through your profile on the website or by sending a request to the Administrator by e-mail, using the form in Annex No. 4 or by a free-form request.
Right to erasure ("right to be forgotten")
Art. 12. (1) You have the right to request from the Administrator the erasure of part or all of the personal data concerning you, and the Administrator is obliged to erase them without undue delay where one of the following grounds applies:
- the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
- you withdraw your consent on which the processing is based and where there is no other legal ground for the processing;
- you object to the processing of personal data concerning you, including for direct marketing purposes, and there are no overriding legitimate grounds for the processing;
- the personal data have been unlawfully processed;
- the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the Administrator is subject;
- the personal data have been collected in relation to the offer of information society services.
(2) The Administrator is not obliged to erase the personal data if it stores and processes them:
- for exercising the right of freedom of expression and information;
- for compliance with a legal obligation requiring processing provided for in Union or Member State law to which the Administrator is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Administrator;
- for reasons of public interest in the area of public health;
- for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes;
- for the establishment, exercise or defence of legal claims.
(3) To exercise your right to be forgotten, you need to send a request by e-mail for the erasure of your personal data processed by the Administrator, by completing the form in Annex No. 2 or by a free-form request, after which the Administrator will send an e-mail to the address you used for registration or for placing orders in the online store, containing detailed instructions for verifying your identity as a user of the store and as the data subject whose data are requested to be erased.
(4) After we verify the identity of the person making the request and the person to whom the data relate in accordance with the instructions sent to you, we will erase all data we process concerning you, in accordance with para. 3.
(5) If you have an order in process, the earliest time you may request to be "forgotten" is upon successful completion of the order.
Right to restriction of processing
Art. 13. You have the right to request from the Administrator restriction of processing of data concerning you by sending a free-form request by e-mail when:
- you contest the accuracy of the personal data, for a period enabling the Administrator to verify the accuracy of the personal data;
- the processing is unlawful but you oppose the erasure of the personal data and request the restriction of their use instead;
- the Administrator no longer needs the personal data for the purposes of the processing, but you require them for the establishment, exercise or defence of legal claims;
- you have objected to processing pending the verification whether the legitimate grounds of the Administrator override your interests.
(2) Once we receive your request, we will send an e-mail to the address you used for registration or for placing orders in the online store, containing detailed instructions for verifying your identity as a user of the store and as the data subject whose data are requested to be restricted.
(3) After the verification under para. 2 is carried out, the Company will cease processing your data, but will not remove any publications you have made in the online store, if any.
Right to data portability
Art. 14. (1) Where you have given consent to the processing of your personal data or the processing is necessary for the performance of a contract with the Administrator, or your data are processed by automated means, you may:
- request from the Administrator to receive your personal data in a structured, commonly used and machine-readable format and transmit those data to another Administrator;
- request from the Administrator to transmit your personal data directly to a designated Administrator, where technically feasible.
(2) You may exercise your right to data portability by sending us a completed form as per Annex No. 3 by e-mail or a free-form request, after which the Administrator will send an e-mail to the address you used for registration or for placing orders in the online store, containing detailed instructions for verifying your identity as a user of the store and as the data subject whose data portability is requested.
(3) After the verification under para. 2 is carried out, the Company will send to the e-mail address specified by you the data it processes concerning you in XML format.
Right to be informed
Art. 15. You may request from the Administrator to inform you about all recipients to whom personal data for which rectification, erasure or restriction of processing has been requested have been disclosed. The Administrator may refuse to provide this information where this proves impossible or would involve disproportionate effort.
Right to object
Art. 16. You may object at any time to the processing of personal data concerning you by the Administrator, including where the data are processed for the purposes of profiling or direct marketing.
Your rights in the event of a personal data security breach
Art. 17. (1) Where the Administrator establishes a personal data breach likely to result in a high risk to your rights and freedoms, it will notify you without undue delay of the breach and of the measures taken or proposed to be taken.
(2) The Administrator is not obliged to notify you if:
- it has implemented appropriate technical and organisational protection measures with respect to the data affected by the breach;
- it has taken subsequent measures that ensure that the high risk to your rights is no longer likely to materialise;
- the notification would involve disproportionate effort.
Persons to whom your personal data are disclosed
Art. 18. (1) For the purposes of processing your personal data and providing the service in its full functionality and with a view to your interests, the Administrator discloses the data to its employees solely for the purpose of fulfilling an order.
(2) The personal data processors comply with all requirements for lawfulness and security in the processing and storage of your personal data.
Art. 19. The Administrator does not transfer your data to third parties or third countries.
Art. 20. In case your rights under the above or under the applicable data protection legislation are violated, you have the right to lodge a complaint with the Commission for Personal Data Protection as follows:
Name: Commission for Personal Data Protection
Registered office and address: Sofia 1592, "Prof. Tsvetan Lazarov" Blvd. No. 2
Correspondence address: Sofia 1592, "Prof. Tsvetan Lazarov" Blvd. No. 2
Telephone: 02 915 3 518
Website: www.cpdp.bg
Art. 21. You may exercise all your rights relating to the protection of your personal data through the forms attached to this information. Of course, these forms are not mandatory and you may submit your requests in any form that contains a statement to that effect and identifies you as the data subject.
Art. 22. If consent relates to a transfer, the Administrator shall describe the possible risks of transferring the data to third countries in the absence of an adequacy decision and appropriate safeguards.
Annex No. 1
Form for withdrawal of consent for processing purposes
Your name*: .........................
Your e-mail used in the online store*: .........................
Contact details (e-mail)*: .........................
To
Name: .........................
UIC/BULSTAT: .........................
Registered office and address: .........................
Correspondence address: .........................
Telephone: .........................
E-mail: .........................
Website: .........................
With this I hereby withdraw my consent for the processing of the personal data provided by me for the purposes of receiving newsletters, marketing communications or other promotional materials, being aware of the conditions for withdrawal of consent in accordance with the Mandatory information on the rights of data subjects under personal data protection law of the online store.
In case your rights under the above or under the applicable data protection legislation are violated, you have the right to lodge a complaint with the Commission for Personal Data Protection as follows:
Name: Commission for Personal Data Protection
Registered office and address: Sofia 1592, "Prof. Tsvetan Lazarov" Blvd. No. 2
Correspondence address: Sofia 1592, "Prof. Tsvetan Lazarov" Blvd. No. 2
Telephone: 02 915 3 518
Website: www.cpdp.bg
Annex No. 2
Request "to be forgotten" – for erasure of personal data concerning me
Your name*: .........................
Your e-mail used for registration or for placing orders in the online store*: .........................
Contact details (e-mail)*: .........................
To
Name: .........................
UIC/BULSTAT: .........................
Registered office and address: .........................
Correspondence address: .........................
Telephone: .........................
E-mail: .........................
Website: .........................
Please erase from your databases all personal data concerning me that you collect, process and store, provided by me or by third parties related to me, according to the identification provided.
I hereby declare that I am aware that some or all of my personal data may continue to be processed and stored by the Administrator for the purposes of fulfilling its legal obligations.
In case your rights under the above or under the applicable data protection legislation are violated, you have the right to lodge a complaint with the Commission for Personal Data Protection as follows:
Name: Commission for Personal Data Protection
Registered office and address: Sofia 1592, "Prof. Tsvetan Lazarov" Blvd. No. 2
Correspondence address: Sofia 1592, "Prof. Tsvetan Lazarov" Blvd. No. 2
Telephone: 02 915 3 518
Website: www.cpdp.bg
Annex No. 3
Request for data portability
Your name*: .........................
Your e-mail used for registration or for placing orders in the online store*: .........................
Contact details (e-mail)*: .........................
To
Name: .........................
UIC/BULSTAT: .........................
Registered office and address: .........................
Correspondence address: .........................
Telephone: .........................
E-mail: .........................
Website: .........................
Please send in XML format to the following address all personal data relating to me that are collected, processed and stored in your databases:
e-mail: .........................
Administrator – recipient of the data: .........................
Name: .........................
Identification number (UIC, BULSTAT, registration number with CPDP): .........................
E-mail: .........................
In case your rights under the above or under the applicable data protection legislation are violated, you have the right to lodge a complaint with the Commission for Personal Data Protection as follows:
Name: Commission for Personal Data Protection
Registered office and address: Sofia 1592, "Prof. Tsvetan Lazarov" Blvd. No. 2
Correspondence address: Sofia 1592, "Prof. Tsvetan Lazarov" Blvd. No. 2
Telephone: 02 915 3 518
Website: www.cpdp.bg
Annex No. 4
Request for data rectification
Your name*: .........................
Your e-mail used for registration or for placing orders in the online store*: .........................
Contact details (e-mail)*: .........................
To
Name: .........................
UIC/BULSTAT: .........................
Registered office and address: .........................
Correspondence address: .........................
Telephone: .........................
E-mail: .........................
Website: .........................
Please rectify the following personal data, which you collect, process and store, provided by me or by third parties related to me, as follows:
Data to be rectified:
..................................................
Please rectify them as follows:
..................................................
In case your rights under the above or under the applicable data protection legislation are violated, you have the right to lodge a complaint with the Commission for Personal Data Protection as follows:
Name: Commission for Personal Data Protection
Registered office and address: Sofia 1592, "Prof. Tsvetan Lazarov" Blvd. No. 2
Correspondence address: Sofia 1592, "Prof. Tsvetan Lazarov" Blvd. No. 2
Telephone: 02 915 3 518
Website: www.cpdp.bg