Privacy Policy

1. IDENTIFICATION OF ZORA DESIGN LTD.

ZORA DESIGN LTD. (hereinafter ZORA DESIGN or "Administrator") is a personal data administrator. ZORA DESIGN LTD. is a sole limited liability company registered in the Bulgarian Commercial Register at the Registry Agency with UIC BG203324842, represented by its manager Zora Romanska.

2. CONTACT WITH THE ADMINISTRATOR

You can contact the Administrator in one of the following ways:

postal address: 20 Yoan Ekzarh Street, SOFIA 1421
email: info@zoraromanska.com
website: zoraromanska..com
contact person: Zora Romanska

3. PERSONAL DATA PROCESSED BY THE ADMINISTRATOR

The Administrator collects and processes your personal data in connection with your access to and use of the website maintained by the Administrator www.zoraromanska.com, making contact with website users, as well as the functioning of the Administrator's online store on the website www.zzone.bg and concluding contracts for the sale of goods from the online store, including - in the course of the execution of contracts for the sale of goods from the online store, on the basis of Article 6, Paragraph 1 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter the "General Data Protection Regulation").

In addition, to personalize your preferences for better service, the Administrator may collect and subsequently process certain information regarding your browsing behavior on the website and use of the online store.

When operating the online store, the Administrator may store and collect information through "cookies" and similar technologies in accordance with the Policy on the Use of "Cookies" and Other Similar Technologies (hereinafter the "Cookie Policy"), available on the online store's website.

The Administrator does not collect or otherwise process sensitive data included in special categories of personal data in the General Data Protection Regulation. In addition, the Administrator does not wish to collect or process data of minors under 16 years of age.

3.1. Personal data

The personal data that the Administrator collects and processes about you are:

3.1.1. Personal data that is automatically collected:

Log Files - by accessing the zoraromanska.com website from your side, the Administrator automatically receives information from log files (a set of system information about the user): internet protocol (IP) addresses, browser type and language, internet service provider (ISP), referring and exit pages, operating system, date/time stamp, as well as clickstream data; the time you spent on a given site and which pages on the site you visited. The information contained in these files includes the use of "cookies" - more information about the use of "cookies" can be found in the Cookie Policy available at www.zoraromanska.com

3.1.2. Personal data that you provide:

names;
postal address, email address;
telephone;

Please note that the data that may be required for payment - bank account, number, dates and/or bank card data are not received by the Administrator, but by the third party through which the payment is made. The Administrator has no control over the processing of this data by the third party and cannot be held responsible for its processing.

3.2. Legal basis for processing personal data by the Administrator

The Administrator processes your personal data on the basis of:

a/ Article 6, paragraph 1, letter a) of the General Data Protection Regulation, namely - based on your explicit consent regarding access to and browsing of the online store's website and/or communication with the online store and/or creating a profile in the online store and/or using "cookie" files;

b/ Article 6, paragraph 1, letter b) of the General Data Protection Regulation, namely for taking steps prior to the conclusion of a contract, as well as for the conclusion and execution of the concluded contract for the sale of goods from the online store;

c/ Article 6, paragraph 1, letter c) of the General Data Protection Regulation, namely - processing is necessary for compliance with a legal obligation to which the Administrator is subject, including, but not limited to - for compliance with the Administrator's legal obligations under the Accounting Act and applicable tax legislation;

d/ Article 6, paragraph 1, letter e) of the General Data Protection Regulation, namely - processing is necessary for the purposes of the legitimate interests of the Administrator for carrying out and protecting its business activities (including, but not limited to - measures for the protection of the website and its users, measures for preventing and detecting attempts at fraud; measures for managing various other risks);

3.3. Purposes of processing personal data by the Administrator

The specified personal data, provided by you in connection with your access to and browsing of the website www.zzone.bg, communication, creation of a profile and use of the online store, including - when concluding a contract for the sale of goods from the online store, are processed by the Administrator for the following purposes:

access to and browsing of the zzone.bg website, where the online store is located;
contacting users of the zzone.bg website;
creating a profile and providing full functionality when using the online store;
individualization of a party to the contract and execution of the contract for the sale of goods from the online store (processing orders, confirmation, delivery and invoicing of an order placed; checking, confirming and processing payments and transfers; cancellation of orders, complaints, return of goods and other actions of any nature related to an order and/or contract for the sale of goods from the online store; providing access to services, including execution of contracts for the sale of goods from the online store and all relations between the parties in connection with such contracts), as well as fulfillment of the Administrator's resulting legal and contractual obligations;
for the operation and improvement of the online store's website, for analyzing the behavior of website visitors and for marketing purposes;
in fulfillment of legal obligations in the field of accounting and tax legislation.

3.4. Your specified personal data may be provided to the following recipients and categories of recipients:

a) competent state authorities - in fulfillment of the Administrator's obligations under Bulgarian law;

b) providers of various services to the Administrator, as follows:

legal, tax and other consultants and auditors;
provider under a contract for the provision of accounting and financial services;
courier under a contract for courier services (DHL, "Speedy" AD) for the delivery of goods ordered by you, as a consumer of the online store and buyer under the concluded contract for the sale of goods from the online store;
providers of payment/banking services and banking institutions (PayPal and all banks and bank branches in the Republic of Bulgaria and abroad) regarding the administration of money transfers in connection with the concluded contract for the sale of goods from the online store;
providers of marketing services;
providers of services related to market research;
insurance companies;
IT service providers;
other companies with which the Administrator may develop joint programs for marketing the goods offered by the Administrator in the online store.
other companies - suppliers of the Administrator in connection with the functioning of the website and online store, including - providers of programs and web solutions - Google products and services and other online platforms.

If the Administrator is legally obligated, or if it is necessary to protect its legitimate interests, the Administrator may also disclose certain personal data to public authorities.

The Administrator guarantees that access to your data by private third-party entities is carried out in accordance with legal provisions in the field of data protection and information confidentiality, based on contracts concluded with them.

3.5. Retention period for personal data provided by the Administrator

a) For the duration of the contract for the sale of goods from the online store, concluded between you and the Administrator, and for the 5-year limitation period thereafter;

b) For the duration of your profile's existence in the online store. After your profile is deleted, the Administrator will take the necessary measures to delete and/or anonymize your personal data provided in connection with the use of the online store;

c) For the period until the website user withdraws consent (if the processing of personal data depends on the website user's consent), respectively - for the period until the website user raises an objection (if the processing of personal data is related to "cookie" technology and other similar and/or marketing activities) and in accordance with the technical possibilities for deleting these files, while browser/device settings are used;

d) For a longer period, if required by law (e.g., accounting or tax regulations). In case an extension of the data retention period is necessary to fulfill a legal or contractual obligation of the Administrator and/or legitimate interests of the Administrator or a third party, you will be duly notified by the Administrator.

3.6. Transfer of personal data outside the territory of Bulgaria

The Administrator does not intend to transfer your collected personal data to recipients in countries outside the European Union and/or the European Economic Area. Nevertheless, in the event that some of your personal data are transferred to entities located outside the European Union, including in countries for which the European Commission has not recognized an adequate level of personal data protection, the Administrator will take action to ensure that any international transfer of personal data is carefully managed to protect your rights and interests.

4. YOUR RIGHTS IN CONNECTION WITH YOUR PERSONAL DATA PROCESSED BY THE ADMINISTRATOR

You have the right at any time to request the following from the Administrator:

4.1. Correction of your personal data, in case the personal data processed about you is inaccurate. You also have the right to have your incomplete personal data completed, including by means of providing a supplementary statement.

4.2. Erasure of your personal data, in case:

a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

b) you withdraw your consent on which the processing of your personal data is based (for personal data processed based on consent), as described in detail in item 4.5 below;

c) you object to the processing, as described in detail in item 4.4 below, and there are no overriding legitimate grounds for the processing, as well as in all cases where you object to the processing of personal data for direct marketing purposes, including profiling to the extent that it is related to such direct marketing;

d) your personal data has been unlawfully processed;

e) your personal data must be erased for compliance with a legal obligation of the Administrator under Bulgarian and/or European Union law;

The Administrator may not fulfill your request for the erasure of your personal data if their processing is required:

– for compliance with a legal obligation; or

– for the establishment, exercise or defense of legal claims;

4.3. Restriction of the processing of your personal data, in case:

a) you contest the accuracy of the personal data - for a period enabling the Administrator to verify the accuracy of your data;

b) the processing of personal data is unlawful, but you do not want the personal data to be erased and instead request the restriction of their use;

c) the Administrator no longer needs the personal data for the specified purposes, but you require them for the establishment, exercise or defense of legal claims.

d) you have objected to processing, as described in detail in item 4.4 below, pending the verification whether the legitimate grounds of the Administrator override your interests;

You have the right at any time to:

4.4. Object to the processing of your personal data, in case:

a) the processing of your personal data is necessary for the purposes of the legitimate interests of the Administrator or a third party;

b) your personal data are processed for direct marketing purposes;

c) your personal data are processed for scientific and/or historical research purposes or for statistical purposes.

4.5. Withdraw consent for data processing.

You can withdraw your given consent for the processing of your personal data at any time (regarding personal data processed based on consent) - but this will not affect the lawfulness of processing carried out by the Administrator based on your consent before its withdrawal. Regardless, the Administrator will process your data for purposes related to the execution of the contract for the sale of goods from the online store concluded between you and the Administrator, as well as any possible disputes between you and the Administrator in connection with or arising from the concluded contract for the sale of goods from the online store.

You can exercise all rights under item 4 by sending a written request to the Administrator's address or an electronic request to the Administrator's email, as stated above in item 2 of this document.

5. RIGHT OF ACCESS TO DATA

You may request from the Administrator:

a) to confirm that they are processing your personal data;

b) to provide you with a copy of this data;

c) to provide you with information regarding your personal data;

If you wish to receive additional copies of the medium on which your personal data has been provided to you, you may be charged a reasonable administrative fee.

6. RIGHT TO DATA PORTABILITY

You have the right to receive the personal data concerning you, which you have provided to the Administrator, in an appropriate format and to transfer this data to another personal data administrator, with respect to the personal data processed by the Administrator based on your consent or for the performance of the contractual obligations under the contract for the sale of goods from the online store, and when the processing of this personal data is carried out automatically (i.e. through automated electronic systems, and not in the form of a paper archive). You have the right to receive direct transfer of personal data from the Administrator to another personal data administrator when this is technically feasible.

7. RIGHT TO LODGE A COMPLAINT WITH A SUPERVISORY AUTHORITY

You have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP) if you believe that your personal data is being processed unlawfully or your rights in connection with your personal data have been violated.

Contact CPDP:

Sofia 1592, Prof. Tsvetan Lazarov Blvd. No. 2,

Email: kzld@cpdp.bg,

Website: www.cpdp.bg.

8. PROVISION OF PERSONAL DATA

Please note that the provision of your personal data in connection with placing an order and concluding a contract for the sale of goods from the online store is necessary for the conclusion and performance of the contract for the sale of goods from the online store concluded by you and your rights arising from the concluded contract or applicable law. You are not obliged to provide your personal data in connection with placing an order for goods from the online store and concluding a contract for the sale of goods from the online store, but the provision of your personal data is an absolutely necessary condition and requirement for the conclusion of a contract for the sale of goods from the online store and its performance. You may choose not to provide this personal data, and you may at any time exercise your rights regarding the personal data you have provided, but if the Administrator does not have this personal data, this may hinder the performance of the contract of sale concluded by you and the performance of the Administrator's contractual or legal obligations in connection with the concluded contract.

Please note that the provision of your personal data in connection with accessing the online store's website, browsing and using it, including creating a profile in the online store, as well as in connection with sending a message to the online store/Administrator, is necessary for using the website in its full functionality, respectively - for communicating with the online store/Administrator. You may choose not to provide this personal data, and you may at any time exercise your rights regarding the personal data you have provided in connection with accessing the online store's website, browsing and using it, respectively - in connection with communicating with the online store/Administrator, but in this case, the Administrator cannot provide you with access to the content of the online store or guarantee that you will be able to use the website with its full functionality, respectively - in this case, you will not be able to communicate with the online store/Administrator.

9. USE OF AUTOMATED DECISION-MAKING SYSTEM

In order to conduct analyses to improve the website's performance and provide personalized service to each individual user of the website, according to their individual preferences, the Administrator may collect and process data on the user's interests and preferences, such as analyzing the number of visits and/or goods viewed/ordered by that user. This allows for a better understanding of the user's expectations and adaptation to their needs, without, however, significantly affecting their decisions. Thanks to the use of advanced technologies by the Administrator, the above activities can be performed automatically by the system, thanks to which the sent content will be as current and useful as possible for the website user.

The analysis of interests or preferences can also be used to automatically create, provide, and execute specially tailored advertisements, offers, or promotions (discounts) for the user. The result of such actions by the Administrator can significantly influence your consumer choices - for example, the result could be a very good temporary offer for goods addressed only to you based on your purchase history and behavior on the online store's website, which other users of our site will not have access to.

You can request from the Administrator not to be subject to a decision based solely on automated processing, but only when this decision:

a) produces legal effects concerning you; or

b) similarly significantly affects you.

This right is not applicable if the decision made after automated decision-making:

is necessary for the Administrator for the conclusion and/or performance of a concluded contract for the sale of goods from the online store;
is authorized by law and there are adequate safeguards for your rights and freedoms; or
is based on your explicit consent.

10. LINKS TO OTHER WEBSITES

The online store may contain links to other websites. You can separately review the terms and privacy policies applied to these other websites, and the Administrator is not responsible for them. This Policy applies only to the Administrator's activities mentioned above.

This Personal Data Privacy Policy was adopted on 03.12.2019 and is valid until its revocation or amendment by publishing such revocation or amendment on the website www.zoraromanska.com