Privacy policy

Policy for personal data protection in connection with the use of online shop www.castrarubra.bg

Constituted on …

1. WHO ARE WE?

We are “Bulgarian wine industry” AD, UIN 203606927, owner of the trade mark CASTRA RUBRA also known as CASTRA RUBRA ("Company", "CASTRA RUBRA", "we“, "us“).
We are a Seller of the Goods offered at the Electronic shop www.castrarubra.bg ("Electronic shop") and the owner of the Electronic shop.

We encourage you to contact us if you have any questions, incomprehension or objections according your personal data procession form our side while you use our website www.castrarubra.bg and your shopping experience with the Electronic shop.

2. CONTACTS

You may contact us as follow:

Legal address: 6460 Kolarovo, Harmanli municipality, Haskovo district
e-mail address for contact with the Electronic shop: info@castrarubra.bg
phone number: +359 888 688 377
Any mean of contact indicated on the website of the Electronic shop www.castrarubra.bg

Legal authority: Commission for personal data protection ("CPDP")
Address: Sofia 1592, Bulgaria, 2 Prof. Tsvetan Lazarov Blvd.
phone: 02 915 3519
fax: 02 915 3525
e-mail: kzld@cpdp.bg
website: www.cpdp.bg

You may contact the Commission for personal data protection directly if you consider we have violated your right as and personal data subject.

THIS IS A POLICY FOR PROTECTION OF YOUR PERSONAL DATA

The Electronic shop is managed by “Bulgarian wine industry” AD in conformity with the orders of the Bulgarian Consumer protection law and Regulation (EU) 2016/679 according the individuals protection in connection with personal data procession (GDPR) and the relevant legislation in the field of personal data protection.
As a Customer of the Electronic shop You provide to us certain amount of Your personal data (which is needed to proceed your Order or given under your explicit agreement).
We are an Administrator of Your personal data. We must and we do take the measures needed for its protection. With this document we are explaining You the rights You have as Subject of personal data. You have all rights according GDPR and Consumer protection law.

3. PRIVACY POLICY UPDATE

We may introduce changes in the Policy at any time most likely because of the progress of the digitalization and the dynamic development of the customer legislation, electronic trade and the European regulation connected with the personal data processing in such relation.

4. PERSONAL DATA AND OTHER CONCEPTS USED IN THIS PRIVACY POLICY

“Personal data” – this is every information connected with You as an individual (every user of the Electronic shop) which by itself or in combination with other information may allow us to identify you or to connect your user behavior with specific device from which you approach our website (for example: electronic address, names, phone number, etcetera).

“Personal data subject” – this is You, the visitor (individual) of the Electronic shop (for example: an individual that creates User profile and places a Purchase through the Electronic shop).

“Personal data processing” – this is every action we take or we may take with Your personal data including but not only their collection, storage, analysis or their destruction (for example: logs storage for User profile, storage of name and address in connection with Your Order processing).

 “Personal data administrator” – in connection with the Electronic shop this is us – “Bulgarian wine industry” AD. We define:

  • the purpose of Your personal data processing and this processing is always carried out on a legitimate reason according GDPR;
  • the means this processing is done with (for example: the technical infrastructure and the applications the processing is done with).

The responsibility in regards of Your personal data security and protection arise for us when we process them independently. When we process Your personal data with another party, different from us (for example: payment service operator, courier), the other party, as far as it is another Administrator (joint Administrator) also bears responsibility for the security and protection of Your personal data.

“Personal data operator” - this is a third party, different from us, that processes Your personal data on our entrust and explicit instructions with which “Bulgarian wine industry” AD has defined the purpose and the meanings with which the processing is done and have checked up if this party confirms with GDPR.

“Electronic shop” – this is a software to which is approached through Internet using a web browser or mobile application available at www.castrarubra.bg and through which software a sale of goods is done by means of non-attendance contract with “Bulgarian wine industry” AD. More information for the type of the goods sold may be found in the corresponding General conditions available at www.castrarubra.bg.

5. WE PROCESS YOUR PERSONAL DATA

We collect, use and store Your personal data needed for the sale of the goods offered through the Electronic shop.

Information for You is also gathered when you use (browse) our Electronic shop (for example: when You manage Your User profile, place a Purchase, You subscribed for our Newsletter).
Below are listed examples for the type of information which we may collect for You, the manner we may use it and the legal reason on which we use it.

WHAT PERSONAL DATA DO WE COLLECT?

We are doing our best to collect the minimum amount of Your personal data and only the part we need to carry out our activity through the Electronic shop. For example:

  • when You create a User profile by registering with the Electronic shop (in order to manage the access and identification of Your profile): names and e-mail address;
  • when You place an Order with the Electronic shop; Your names; Your e-mail address; delivery address (Yours or Third party individual’s address indicated by You); phone number for contact (Yours or Third party individual’s phone number indicated by You). In case in the time You place an Order You have indicated address, phone number or address of Third party individual these are personal data of the Third party individual and we will process them in connection with Your order. In any case You provide a Third party individual’s personal data we will assume You have informer such person that you have indicated one’s personal data to us.
  • when you pay through the virtual vPOS terminal maintained on the web site of the Electronic shop: payment details and protection of Your data connected with the payment which may be result of the approved transaction, amount of purchase and so on;
  • data for issuance of document registering the sale according the legislation and payment method (for example: unique number of customer’s order; quantity and value of the goods/services purchased; price, total value for payment and payment method; name, phone number, address);
  • when You have subscribed for our Newsletter – e-mail address; our goal with this operation is to manage the process of Newsletter dispatch to the Customers who subscribed to the Newsletter.

Customer communication when an e-mail inquiry has been sent – e-mail address, names, phone number.

WHAT ARE THE GOALS WE USE YOUR PERSONAL DATA FOR?

Processing purposes:

The principal goals we use your personal data for are mainly connected with the execution of Your purchase and to guarantee your security during the purchase process. On other side we use Your personal data in connection with our legal duty as electronic trader.
We will not process your personal data with goals that differs with the initial goals we have collected it for except if there is similarity in our initial processing goals and our following processing goals.
The goals we process Your personal data for will always be the same but in case we change these goals we will inform You in any such case.

Enclosed are the goals we pursue:

  • activities for the management of the Electronic shop;
  • data in connection with execution of a Purchase placed and execution or termination of a Contract concluded;
  • book-keeping and issuance of documents that registers the sale of Goods through the Electronic shop according the payment method and the legislation in force;
  • activities for the management of Your User profile with the Electronic shop;
  • activities for the management and dispatch of the Newsletter.

6. LEGAL REASON ON WHICH WE PROCESS YOUR PERSONAL DATA

The legal reason we process Your personal data differs on the goals we have gathered them for as well as our concrete relationship with You (for example: Contract for Purchase of Goods through the Electronic shop). When our goals change we will always process your personal data in conformity with the law and only when we have a legal reason for such processing.

Enclosed are the reasons we may process Your personal data on:

  • execution of Contract for sale of Goods concluded with us or You taking an action for conclusion of such Contract;
  • our relationship with You is mainly because You use our Electronic shop to purchase goods through non-attendance and our legal reason to collect and process Your personal data is clause 6, paragraph 1, letter “b” of GDPR (actions before concluding a Contract and execution of concluded between You and us Contract);
  • legal reasons according the fiscal legislation, insurance legislation and consumer legislation in force (including electronic trade).

Even after termination or execution of a Contract we store some personal data for period not longer then stated in that Privacy policy except if such storage is not required by the legislation in force (for example: fiscal information must be kept for the time stated in the corresponding legislation).

Explicit agreement from You, given in advance to process Your personal data

We process Your personal data for Newsletter dispatch and communication with You in regards with it according clause 6, paragraph 1, letter “a” of GDPR (explicit agreement from You, given in advance). In the cases You have provide Your agreement for specific personal data process (for example: use of Cookies so You may receive the Newsletter) it is important for You to know that You may in any time withdraw it.

7. COOKIES

The Cookies is small amount of text or data provided by our web site to be stored on Your device (computer, laptop, tablet, phone) and may be requested back with the goal to extract information for purposes for which You will be informed in details in advance before the hitch – statistics cookies, marketing cookies or cookies in connection with the functions needed.

More information on the Cookies that our Electronic shop uses you may find in the corresponding Cookies policy available at our web site.

8. DISCLOSURE OF YOUR PERSONAL DATA

In certain cases “Bulgarian wine industry” AD may reveal a certain amount of Your personal data to strategic partners of ours (administrators or personal data operators) that work with us by providing products and services connected with the operations of the Company / Electronic shop, for example:

  • You provide Your personal data needed to complete the payment of the Goods chosen by You at the Electronic shop in online virtual environment (vPOS Postbank) to Postbank (Borika) to which the Electronic shop forwards. There you should enter Your personal data and the information about Your payment means and to confirm the payment. After a successful authorization You will be shifted back to our web site www.castrarubra.bg;
  • we provide Your personal data to the courier company so it may carry out the delivery of Your purchase;
  • we provide Your personal data to the authorities on the ground of their written request and within the limits of their authority.

In any case Your personal details are processed by Third party (so called “Persona data operator”) which is not an Administrator we have done our best so this Third party processes Your personal data closely following our instructions and applying our standards to protect Your personal data.

Personal data operators are companies that provide IT maintenance of our informational systems where we store the personal data of Yours collected through the Electronic shop. The goal of their access to our systems is to assure the regular and secure functioning of the systems as well as the protection of the data processed. Personal data operator and in this role recipient of Your personal data may also be the company hosting our website.

Personal data operators are also all Third party companies that hitch codes and Cookies to Your device while You are visiting our web site. Such companies for example are Google and Facebook.

9. PERSONAL DATA PROTECTION

“Bulgarian wine industry” AD is taking all measures needed - including organizational measures, technical measures and physical measures - to protect Your personal data from loss, theft and abuse as well as unauthorized access to them, their disclosure, change or destruction. For example the communication with the payment server vPOS Postbank is realized through a SSL protocol which is am encoded communication aiming maximum security of the connection and the transfers of this communication on the occasion of the Purchase placed with the Electronic shop.

All employees of “Bulgarian wine industry” AD, including administrators who have rights to operate with the web site of the Electronic shop, are obligated to keep Your personal data in secret as well as to follow the organizational measures and technical measures in order to protect Your personal data. The access to Your personal data by our employees is limited on the need of its use to carry out their duties.

10. PERSONAL DATA STORAGE

Personal data collected through the Electronic shop is stored in our informational data base. The functioning of this data base is secured both with technical measures and organization measures as described above.

The period for storage of Your personal data depends on the goals we process it for as well as the legal reason for this processing and from the period stated in the legislation in force.

Personal data collected by Cookies is stored for the periods stated our Cookie policy.

In order to fulfill our obligations after the period we process Your personal data has expired Your personal data is anonymized (it is transformed so Your identity can not be revealed) or is deleted / destroyed, except when a User has exercised one’s right to ask to restrain / delete one’s personal data.

We store Your personal data collected during the process of online purchase / contract for purchase-sale through the Electronic shop and provided by You for a 5 (five) year period after the limitation period for liquidation of the public debt such online purchase / contract for purchase-sale through the Electronic shop are connected with expires. If legal dispute in connection with the online purchase / contract for purchase-sale through the Electronic shop arouses we store Your personal data until such dispute has been resolved with a court order in power.

Personal data processed in order to issue documents according the fiscal legislation, like but not only – invoices, electronic fiscal receipts, takeover certificates, are stored for a 5 (five) year period after the Purchase is carried out or a Contract terminated which period is fixed in the corresponding legislation. If in another law or legal act a longer period is stipulated, we store Your personal data for the corresponding period.

We do not have access to Your personal data connected with Your payment through the vPOS terminal. We accept only the result for the transactions confirmed. Your personal data connected with Your payment through the vPOS terminal is stored by the bank providing the vPOS (Postbank) and Borika for a period stipulated in the corresponding legislation.

If personal data subject has subscribed for our Newsletter the personal data is stored until one does unsubscribe.

Personal data for which explicit legal reason for storage is not present will be deleted after the goals for which such personal data is collected and processed are carried out.

11. YOUR RIGHTS ACCORDING YOUR PERSONAL DATA

Depending on the initial way Your personal data is collected we will do our best to introduce to You the most important topics according Your rights in a suitable and simple manner. When You have provided Your personal data in order to use the Electronic shop You have at Your disposal the rights listed below. You may exercise those rights at any moment whether by itself or in combination.

11.1. Right to be informed (You want to know what personal data of Yours we process, why and how we process it):

  • for important characteristics of the processing of Your personal data;
  • the purpose, the period and the legal reason we are processing Your personal data;
  • who will receive and who will have access to Your personal data (recipients of personal data and their categories).

11.2. Right of access (You want to obtain information that is a personal data of Yours)

  • in a period of 15 (fifteen) business days after we have received Your request to access Your personal data collected by us we oblige our self to provide such personal data to the e-mail address You have indicated or in other manner of written communication;
  • as for request for the personal data collected by the website’s Cookies in a period of 15 (fifteen) business days we oblige our self to provide to You such information in machine-readable format through the electronic communicational channel preferred by You.

11.3. Right to transfer Your personal data (You want to receive Your data in a systematized structure and/or You want Your personal data to be carried over to another Administrator of personal data).

  • if You ask us to exercise You right to transfer Your personal data more than 2 (two) times per year we, at our own discretion, have the right to charge You with a reasonable fee that covers our expenses for such transfer; in case we are charging such fee You will be informed for its cost in advance;
  • when You exercise Your right to transfer Your personal data, we must provide to You all personal data of Yours that we process in a machine-readable format. We will do this in a 30 (thirty) business days period following the date we have received Your request;
  • the period we need to provide You with Your personal data may vary if the Cookies through which Your personal data is processed, with Your permit, are hitched from domains which are external for us. If this is the case, we will let You know what the period will be once we have received Your request.

11.4. Right of amend (You may ask us to correct personal data of Yours that is inscribed wrong or stored improperly).

  • the right of amend may be exercised along with Your inquiry to access Your personal data or in a separate inquiry;
  • we will amend Your personal data up to 10 (ten) business days period following the date we have received Your request.

11.5. Right to limit the processing of Your personal data.

  • You have the right to ask us to temporarily stop the processing of Your personal data if You have sent us an objection for specific processing of Your personal data or You have present hearing against us, or You have filed a complaint against us with the Commission for personal data protection ("CPDP");
  • in such cases we will temporarily stop the processing of Your personal data. This does not mean we will delete Your personal data. Have in mind that if such cases are present this will impede the carry out Your future Purchase.

11.6. Right to be forgotten / to delete Your personal data

  • You have the right to request from us the deletion of Your personal data. If Your personal data is processed irregularly or is no longer needed for the goals it has been collected for, we will delete it immediately. In any other case Your personal data will be deleted after the legal period we must store it for has expired.

11.7. Process of Your personal data based on legal interest of “Bulgarian wine industry” AD or third party and objection of such process.

  • if Your consent for the specific processing of Your personal data or the processing of Your personal data is not in connection with a service required by You is not requested and provided by You, most probably we have legal interest of ours or third party’s legal interest to do so. We have estimated that such legal interest will not harm nor affect vastly Your rights for inviolability of Your personal data. Such estimate will be always document and will follow definite rules and criterion;
  • You have the right to know the key topics of our articulate argument of our legal interest on request as well as to file an objection that having in mind the special feature of Your situation our processing of Your personal data affects Your rights for inviolability and/or the security of Your personal data vaster than we have estimated. If such case occurs, we have to examine Your objection and reply with articulate argument if we accept or decline Your objection in 30 (thirty) business days period. Along with the filing of such objection You may also exercise Your rights according article 11.5.

11.8. WITHDRAW YOUR AGREEMENT TO PROCESS YOUR PERSONAL DATA

  • in all cases in which we have asked for Your consent to process Your personal data in specific manner (for example: in order You to receive our Newsletter) You must know You may withdraw Your consent at any time;
  • if You are not sure on the reason, on which we are processing Your personal data You may always ask us as well as to send us a request at info@castrarubra.bg or customer@castrarubra.bg for the way You have given Your consent following the procedure of article 11.1 described above. We maintain a data base with all consents given and we may do a checkup with it at any time.

11.9. RIGHT TO FILE A COMPLAINT WITH THE COMMISSION FOR PERSONAL DATA PROTECTION ("CPDP")

  • if you consider that Your rights on GDPR (in the field of personal data protection) are violated or You have any concerns in that connection we are asking You to contact us at info@castrarubra.bg or customer@castrarubra.bg or any other forms of contact stated on the website of the Electronic shop. We will examine and reply to Your request in a reasonable and duly period.
  • You may always file a complaint with the Commission for personal data protection directly. However, we encourage You to firstly contact us for any such situation aroused.

12. HOW TO EXERCISE YOUR RIGHTS?

You have the right to act at any of the manners listed below to exercise any of Your rights or if You consider that with our activity, we have violated more than one of Your rights.

You may file a complaint with us personally or through another person that is legally authorized by You.

You complaint should contain the following attributes: date, Your (electronic) signature, data on which we may identify You (three names, contact phone, e-mail address), description of Your request as well as the preferred communication channel; if You file Your complaint through another person that is legally authorized by You be so kind and enclose the power of attorney.

Your complaint may be filed in the following manners:

  • personally, at our office: 6460 Kolarovo, Bulgaria, Harmanli municipality, Haskovo district;
  • You may send it via post to our office on the address stated;
  • You may send Your complaint electronically to our e-mail info@castrarubra.bg or customer@castrarubra.bg.

Please note that when we have reasonable apprehension connected with Your identity at the moment You are filing Your request to exercise any right of Yours, we may demand additional information from You in order to verify Your identity. If such case occurs, You should have in mind that the period to examine and reply Your request starts its expiration from the moment You provide this additional information.

It is important for You to know that we may decline to fulfil a request of Yours or to fulfil it partially if in another law or the legislation in force there is such limitation is prescripted.

13. PERSONAL DATA OF CHILDREN

We do not aim to collect personal data of persons under the age of 18 (eighteen) but we may not avoid such data collection if underaged person browses our website although such person is completely out of our goal audience as the sale of alcohol to a person under the age of 18 (eighteen) is prohibited by the law. If we understand that we have collected personal data of person under the age of 18 (eighteen) we will take action to delete such collected information as soon as possible. If parent(s) and/or legal guardian of such person find out that person under their tutelage has provided its personal data to “Bulgarian wine industry” AD we kindly ask that parent(s) and/or legal guardian to contact us at our contact details stated in this Privacy policy. We will delete such personal data as soon as possible.