PRIVACY POLICY
Mandatory Information Regarding the Rights of Individuals in Relation to Personal Data Protection
This document constitutes a Privacy Policy and is intended to provide you with comprehensive information regarding the processing of your personal data by BODY MARBLE MAGIC EOOD in accordance with Regulation (EU) 2016/679 (GDPR) and the Bulgarian Personal Data Protection Act.
I. DETAILS OF THE PERSONAL DATA CONTROLLER
Company name: BODY MARBLE MAGIC EOOD
UIC/BULSTAT: 208693544
Registered office and management address: Sofia, Lozenets residential area, 16–20 Golo Bardo Street, Entrance B, Floor 1, Apartment 2
Correspondence address: Sofia, Lozenets residential area, 16–20 Golo Bardo Street, Entrance B, Floor 1, Apartment 2
Contact email:
Website: www.bodymarblemagic.com
(hereinafter referred to as the “Controller” or the “Company”)
II. COMPETENT SUPERVISORY AUTHORITY
Commission for Personal Data Protection (CPDP)
Address: 2 Prof. Tsvetan Lazarov Boulevard, Sofia 1592, Bulgaria
Telephone: +359 2 915 3 518
Website: www.cpdp.bg
III. LEGAL GROUNDS FOR THE PROCESSING OF PERSONAL DATA
The Controller collects, processes and stores personal data on the grounds of Article 6(1) of the GDPR, as follows:
- the explicit consent of the data subject;
- the performance of a contract or taking steps prior to entering into a contract;
- compliance with a legal obligation;
- the legitimate interests of the Controller or a third party.
IV. PURPOSES OF PERSONAL DATA PROCESSING
Personal data is processed for the following purposes:
- creating and maintaining a user account;
- processing and fulfilling orders;
- delivering purchased goods;
- concluding and performing distance contracts;
- accounting and taxation purposes;
- sending newsletters, subject to explicit consent;
- protecting information security;
- complying with legal obligations towards public authorities.
V. CATEGORIES OF PERSONAL DATA
The Controller processes the following categories of personal data:
- identification data – first name and surname;
- contact details – email address, telephone number and postal address;
- delivery information;
- user account information;
- technical data – IP address, cookies and logs;
- marketing data, subject to explicit consent.
The Controller does not process special categories of personal data within the meaning of Article 9 of the GDPR.
VI. COOKIES AND EXTERNAL SERVICES
The website uses cookies and external services such as:
- Google Analytics;
- Google Ads;
- Facebook Ads;
- Mailchimp.
These services may process anonymised or pseudonymised data. Users may manage cookies through their browser settings.
VII. RETENTION PERIODS
- User account data – until the account is deleted;
- Order data – for up to five years;
- Data processed for accounting purposes – for the periods required by law;
- Marketing data – until consent is withdrawn.
VIII. DISCLOSURE AND TRANSFER OF PERSONAL DATA
The Controller may disclose personal data to data processors, such as Mailchimp, where an appropriate agreement is in place and the requirements of the GDPR are observed.
Personal data is not transferred to third countries.
IX. RIGHTS OF DATA SUBJECTS
You have the right to:
- access your personal data;
- rectification;
- erasure, also known as the “right to be forgotten”;
- restriction of processing;
- data portability;
- object to processing;
- withdraw your consent at any time;
- lodge a complaint with the Commission for Personal Data Protection.
X. DATA SECURITY
The Controller applies appropriate technical and organisational measures to protect personal data.
XI. AMENDMENTS TO THE POLICY
This Privacy Policy may be updated, and all amendments shall be published on the website.