I. INTRODUCTION
This Privacy Policy (“Policy”) sets forth the rules regarding the protection of the personal data of individuals using the Website (“Platform”), owned by https://inverso.bg
The website is fully compliant with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“Regulation”), which entered into force on May 25, 2018, and the Personal Data Protection Act (“PDPA”).
By using the Platform you accept and agree to comply with this Privacy Policy, the Cookie Policy, and the Website’s Terms and Conditions.
II. DEFINITIONS
1. “Personal data” means any information relating to a natural person (data subject) who is identified or can be identified, directly or indirectly, by means of an identifier such as: name, national identification number, location information, gender, address, phone number, online identifier, or one or more factors specific to the physical, physiological, genetic, psychological, mental, economic, cultural, or social identity of that natural person.
2. “Processing of personal data” means any operation or set of operations performed on personal data, whether by automated means or otherwise, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making the data available, alignment or combination, restriction, erasure, or destruction.
3. “Data Subject” means any natural person who is a User of
4. “The Website” is , the content of the domain https://inverso.bg, and its subdomains;
III. PRINCIPLES OF PERSONAL DATA PROTECTION
1. Legality, Good Faith, Transparency
Personal data must be processed lawfully, fairly, and in a transparent manner with respect to the data subject. In light of this, https://inverso.bg collects and processes your personal data solely for the following purposes:
a) Management of your request and the contract entered into
i. Based on the contract concluded between us and you, we process information regarding the nature and content of the contractual relationship:
1. personal contact information—full name, contact address, email address, phone number;
2. identification information —full name, unique civil registration number or foreigner identification number, permanent address;
3. emails, letters, and information regarding your requests for issue resolution, complaints, requests, and grievances;
b) retaining correspondence related to orders already placed, processing requests, reporting issues, etc.
c) communicating with the User and sending information to the User.
d) To comply with legal obligations.
2. Limitation of Purposes
Personal data must be collected for specific, explicit, and lawful purposes and must not be processed in a manner that is incompatible with those purposes. https://inverso.bg collects and processes your personal data for the following purposes: creating a profile and providing full functionality when using the online store;
a) placing orders and purchasing services;
b) identification of a party to the contract;
c) accounting purposes;
d) statistical purposes;
e) protection of information security;
3. Data Minimization
Personal data must be adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processedhttps://inverso.bg, in its capacity as Data Controller, anonymizes or pseudonymizes personal data whenever possible to reduce the risks to the data subjects concerned.
4. Accuracy
Personal data must be accurate and, where necessary, kept up to date; reasonable steps must be taken to ensure that inaccurate personal data, having regard to the purposes for which it is processed, is erased or rectified in a timely manner. Inverso is not liable for data incorrectly provided by its Users.
5. Storage Limits
Inverso retains your personal data for no longer than the time until you withdraw your consent to processing. After your account is deleted or your account is successfully closed, the Administrator will take the necessary steps to delete and destroy all your data without undue delay or to anonymize it (i.e., to transform it into a form that does not reveal your identity).
6. Integrity and Confidentiality
Inverso processes your personal data in a manner that ensures an appropriate level of personal data security, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, by implementing appropriate technical or organizational measures;
When we are required by law to do so, we may disclose your personal data to the competent government authority, natural person, or legal entity.
IV. CONSUMER RIGHTS
Every user of the website is entitled to all rights regarding the protection of personal data under Bulgarian law and European Union law.
1. Right of access:
The right of access allows every User to obtain a copy of their data, as well as the right to receive detailed explanations regarding whether the relevant data is being processed lawfully. Every Data Subject has the right to know the following:
a) the purposes for which the provided personal data is used
b) the categories of such data
c) whether the company has shared the data with third parties and, if so, which third parties
d) all sources from which the company has obtained your personal data
e) Retention period for your data
f) any other rights you have against the company, including the right to correct your data, to have your data erased (under certain circumstances), or to restrict or object to the company’s use of your data
g) if the company uses your data in an automated decision-making process (such as decisions made using artificial intelligence or an algorithm), meaningful information about the logic behind that algorithm, as well as the significance and consequences the company anticipates from using your information in this way
h) whether the data is transferred outside the European Union and, if so, what safeguards are in place to protect your data.
2. Right to erasure
The data subject has the right to request that the controller erase personal data relating to him or her without undue delay when any of the following grounds apply:
a) the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
b) the data subject withdraws the consent on which the processing is based, and there is no other legal basis for the processing;
c) the data subject objects to the processing pursuant to Article 21, paragraph 1(GDPR), and there are no legitimate grounds for the processing that override those of the data subject, or the data subject objects to the processing pursuant to Article 21, paragraph 2(GDPR);
d) the personal data was processed unlawfully
e) personal data must be erased in order to comply with a legal obligation under Union law or the law of a Member State to which the controller is subject;
f) the personal data was collected in connection with the provision of information society services as referred to in Article 8(1) of the GDPR,
3. Right to data portability.
The data subject has the right to receive the personal data concerning him or her and which he or she has provided in a structured, commonly used, and machine-readable format, and has the right to transmit that data to another controller without hindrance, where:
a) the processing is based on consent in accordance with Article 6(1)(a) or Article 9(2)(a) (GDPR) or on a contractual obligation pursuant to Article 6(1)(b) (GDPR); and
b) the processing is carried out by automated means
4. Right to Object.
Users have the right to object to the controller regarding the processing of their personal data. The controller is required to cease such processing unless it can demonstrate compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims. If an objection is raised against the processing of personal data for direct marketing purposes, such processing must be discontinued immediately.
V. PROCESSING OF ANONYMIZED DATA
We process your data for statistical purposes, which means for analyses in which the results are only summary in nature and the data is therefore anonymous. It is impossible to identify a specific individual from this information.
1. To comply with regulatory requirements
It is possible that the law requires us to process your personal data. In such cases, we are obligated to carry out the processing, such as:
a) Obligations under the Anti-Money Laundering Act;
b) fulfillment of obligations related to distance sales and off-premises sales, as provided for in the Consumer Protection Act;
c) providing information to the Consumer Protection Commission or to third parties as provided for in the Consumer Protection Act;
d) providing information to the Personal Data Protection Commission in connection with obligations set forth in the personal data protection regulations;
e) obligations set forth in the Accounting Act, the Tax and Social Security Procedural Code, and other relevant legislation, regarding the maintenance of proper accounting records;
f) providing information to the court and third parties in the context of court proceedings, in accordance with the requirements of the laws and regulations applicable to such proceedings;
g) verification of age when shopping online.
2. Processing and Retention Periods
We delete data collected in accordance with a legal obligation once the obligation to collect and store such data has been fulfilled or has ceased to apply, such as:
a) in accordance with the Accounting Act regarding the retention and processing of accounting data (11 years),
b) obligations to provide information to the court, competent government authorities, and other grounds provided for in applicable law (5 years).
VI. DATA SECURITY
To ensure maximum security in the processing, transmission, and storage of your data, we may use additional security measures such as encryption, pseudonymization[1], and others.
Ensuring the security and confidentiality of the personal data you have entrusted to us is our priority. Therefore, we implement all appropriate technical and organizational measures in accordance with applicable legal provisions, taking into account the nature of the personal data you have provided, as well as the risks associated with its processing, in order to maintain its security and, in particular, to prevent any accidental or unlawful destruction, any kind of loss, alteration, disclosure, breach, or unauthorized access to it.
1. The security measures we have put in place
We are required to comply with the Payment Card Industry Data Security Standard (“PCI DSS”), published by the PCI Security Standards Council (“PCI SSC”). This standard was created to enhance the protection of cardholder information in order to reduce the fraudulent use of payment instruments. We meet the requirements of the PCI DSS. We are committed to combating identity theft online. For this reason, for example, we use a system to detect fraudulent credit card payments. We protect our network with hardware devices (firewalls, IDS, DLP, etc.) as well as state-of-the-art architectures (including secure protocols such as TLS) to prevent and mitigate the risk of malware. We have internal processes based on the best standards, specifically the ISO 27000 family of standards, to maintain a level of security in line with best practices.
VII. RESPONSIBILITIES OF DATA PROTECTION OFFICERS (DPOs)
The company's designated employees assist the Data Controller or the data processor in all matters related to the protection of personal data. Specifically, they must:
a) to inform and advise the Controller and/or the data processor, as well as their employees, regarding their obligations under the Data Protection Act;
b) to ensure that the organization complies with all data protection laws, including through audits, awareness-raising activities, and training for staff involved in processing operations;
c) to provide advice when a Data Protection Impact Assessment (DPIA) has been conducted and to monitor its implementation;
d) to serve as a point of contact for requests from individuals regarding the processing of their personal data and the exercise of their rights;
e) to cooperate with the Data Protection Authorities (DPA) and to serve as a point of contact for the DPA on matters related to processing.
VIII. INCIDENT REPORTING PROCEDURE
Every User has the right to file a complaint regarding the unlawful processing of their personal data with the Personal Data Protection Commission or with the competent court.
Name: Commission for Personal Data Protection
Headquarters and Registered Office:
Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.
Mailing Address:
Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.
Phone: +3592/91-53-518
Website: www.cpdp.bg
IX. CONTACT INFORMATION:
Any user may submit an inquiry or exercise their rights under this Privacy Policy by sending an email to info@inverso.bg and/or using the contact information provided in the “Contact Us” section of the Website.
Date: October 1, 2024
