Privacy Policy
POLICY FOR SECURITY OF PERSONAL DATA OF NATURAL PERSONS
This document contains the Policy for the security of personal data of natural persons ("Policy") and is related to the General Terms and Conditions, but is not an integral part of them, as it does not regulate rights and obligations, but aims to explain to users what personal data we process, in what way, for what purpose and what are the applicable security measures. It also provides information about the rights that you, our customers and users, have in relation to the processing of personal data by "PRO VANITY" EOOD (www.lollipopcosmetics.com). If the Policy changes, the changes will be posted here. Date of update: 02/01/2020Your privacy is extremely important to us. This security policy discloses what personal data we collect from you through our joint relationships and how we use that data.
ADMINISTRATOR OF PERSONAL DATA
"PRO VANITY" EOOD, EIK 205237247, with headquarters and management address: Stara Zagora, 53 Lyuben Karavelov St., fl. 3, apartment 9, contact phone +359 879 629 981, email: lollipopcosmetics@abv.bg (hereinafter referred to as "Lollipop", "We", "online store", "Site", "Website", "administrator") is the controller of data, including personal data, regarding the information collected or provided when viewing the site www.lollipopcosmetics.com or when making a purchase through it, as well as when viewing or purchasing a product or service through our Facebook page (collectively referred to as "Site", "Website" for short) ).The policy also applies in cases where as natural persons (for short "Subjects") you voluntarily provide us electronically (via e-mail), by telephone or by other means, including on-site at our retail outlet or office personal data Lollipop processes personal data also from inquiries made by you to us, as well as for marketing and advertising purposes, profiling, participation in games, promotions and raffles organized by us and for any other purposes not prohibited by law. When processing personal data, Lollipop complies with all applicable data protection regulations, including but not limited to Regulation (EU) 2016/679 ("Regulation") and the Personal Data Protection Act, because for us the security of the personal data of our customers is of primary importance. Therefore, this Policy applies in this case as well.
DATA PROTECTION OFFICER
The person responsible for data protection is Georgi Marinov Correspondence address: Stara Zagora, 53 Lyuben Karavelov St., 3rd floor, apartment 9 Email address: lollipopcosmetics@abv.bg Contact phone: +359 879 629 981
APPLICABILITY OF THE POLICY
This Policy applies to all our customers - natural persons using our services by ordering from the Site or showing interest in the same by sending inquiries (hereinafter referred to as "data subjects", "users").
Partners and third parties who work with or for Lollipop, and who have or may have access to personal data, will be expected to familiarize themselves with, understand and comply with this policy. No third party may have access to personal data stored by Lollipop without the company having previously entered into a data confidentiality agreement that imposes on the third party obligations no less onerous than those undertaken by Lollipop, and which gives Lollipop the right to carry out checks on compliance with the obligations imposed by the agreement.
This policy applies to all employees/employees (and stakeholders) of Lollipop, as well as external suppliers of products and services with whom Lollipop has contracts. Any violation of the General Regulation will be considered as a violation of labor discipline, resp. such as non-fulfillment of contracts with partners, and in case there is an assumption of a crime committed, the matter will be submitted for examination in the shortest possible time to the relevant state authorities.For Site visitors who do not place orders or send inquiries, but only browse our website, the Cookie Policy adopted and published on the Site applies.
DEFINITIONS
"Regulation" - General Data Protection Regulation 2016/679 of April 27, 2016, referred to as GDPR. The purpose of this European legislation is to protect the "rights and freedoms" of individuals and to ensure that personal data is not processed without their knowledge and, where possible, is processed with their consent.
"Personal data" - any information relating to an identified natural person or an identifiable natural person ("data subject"); an identifiable natural person is a person who can be identified directly or indirectly, in particular by an identifier such as a name, an identification number, location data, an online identifier or by one or more characteristics specific to the physical, physiological , the genetic, psychic, mental, economic, cultural or social identity of that natural person.
"Special categories of personal data" - personal data revealing racial or ethnic origin, political views, religious or philosophical beliefs, or trade union membership and the processing of genetic data, biometric data for the unique identification of a natural person, data relating to health or data regarding an individual's sex life or sexual orientation.
"Processing" - any operation or set of operations performed on personal data or a set of personal data by automatic or other means such as collection, recording, organization, structuring, storage, adaptation or modification, retrieval, consultation, use, disclosure by transmission, distribution or other way in which the data is made available, arranged or combined, restricted, deleted or destroyed;
"Administrator" - any natural or legal person, public body, agency or other structure that alone or jointly with others determines the purposes and means of processing personal data; when the purposes and means of such processing are determined by EU law or the law of a Member State, the controller or the special criteria for its designation may be laid down in Union law or in the law of a Member State;
"Data subject" - any living natural person who is the subject of the personal data stored by the Administrator.
"Consent of the data subject" - any freely expressed, specific, informed and unequivocal indication of the will of the data subject, by means of a statement or a clear affirmative action, which expresses his consent for the personal data related to him to be processed;
"Child" - The General Regulations define a child as anyone under the age of 16 years. The processing of a child's personal data is only lawful if a parent or guardian has given consent. The administrator makes reasonable efforts to verify in such cases that the holder of parental responsibility for the child has given or is authorized to give consent.
"Profiling" - any form of automated processing of personal data, consisting in the use of personal data to assess certain personal aspects related to a natural person, and more specifically to analyze or predict aspects related to the performance of professional duties that individual's economic status, health, personal preferences, interests, reliability, conduct, location or movement;
"Breach of personal data security" - a security breach that results in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access to personal data that is transmitted, stored or otherwise processed;
"Recipient" - a natural or legal person, public body, agency or other structure to which the personal data is disclosed, regardless of whether it is a third party or not. At the same time, the public authorities that may receive personal data within the framework of a specific investigation in accordance with the law of the Union or the law of a Member State, are not considered "recipients"; the processing of this data by the specified public authorities complies with the applicable data protection rules in accordance with the purposes of the processing;
"Third party" – any natural or legal person, public body, agency or other body other than the data subject, the controller, the personal data processor and the persons who, under the direct supervision of the controller or the personal data processor, have the right to process the personal data ;
PRINCIPLES
When collecting and processing personal data, we are guided by the following principles: legality, good faith, transparency; limitation of objectives; data minimization; accuracy; storage limitation; integrity and confidentiality; accountability.
ENTITIES WHOSE DATA WE PROCESS
In connection with its activity, Lollipop enters into and executes distance sales contracts, reviews job applications and proposals, forms for the exercise of rights of users buyers, as well as requests of data subjects, responds to inquiries, issues and receives invoices, processes statistical data, manages a user panel on the site, carries out advertising activities through advertising campaigns (promotions, games, etc.). In the course of these activities, Lollipop processes information about the following Data Subjects:
(a) natural persons, users of the site without registration without leaving any data (in this case we process data, but not personal) and natural persons, users of the site without registration, who have provided a limited number of personal data voluntarily ( example phone number and or email address);
(b) natural persons, users of the site with registration as registered users - in these cases we process data about the user that he entered during registration - email address, delivery address, names, invoicing data, order details, other data, entered by the user.
(c) natural persons who have sent inquiries (including by phone), requests, initiatives, signals, complaints or other correspondence to us, including through the website, telephone, e-mail or otherwise;
(d) natural persons, information about which is contained in inquiries (including by call), requests, initiatives, signals, complaints or other correspondence addressed to us; (e) natural persons with whom we conclude contracts (civil, including commercial or employment, especially distance contracts) electronically (via the site or social networks, as well as by means of electronic correspondence) or on site at our office or commercial establishment;
(f) natural persons whose data we have obtained through the provision of them by third parties (for example, in the case of an order intended for a gift).
PERSONAL DATA WE PROCESS
Depending on the reason for the processing of personal data, the type of such data may differ. The functionalities provided on the Site are not intended for storage and processing of special categories of data within the meaning of Art. 9 and Art. 10 of the Regulation. (NB! Read Art. 9 and Art. 10 - of the Regulation here). We only require such personal data as are necessary for us to provide the activity/service/product requested from us. In the course of using the site by natural persons, we may also process other data that do not contain personal data, but relate to the subject, such as his IP address, data on his activity on the site, etc. similar.
Data provided when placing an order
In order to fulfill a remote contract (order) concluded between you and Lollipop, we require certain information from you. You decide for yourself whether and how to use the possibilities for concluding a distance sales contract provided through the Site or the Facebook page. In the forms through which personal data is entered, we clearly indicate the mandatory or voluntary nature of providing the data. The data, the filling of which is mandatory, are those without which it is impossible to conclude the relevant contract. These are: names, e-mail address, delivery address, contact phone number, your payment information (e.g. bank card), invoicing data, of which also the TIN if you want an invoice for an individual. If you provide data to third parties who will receive the order (for example, in the case of orders for the purpose of a gift or other type of donation), you are responsible for providing the data to these third parties.
Data provided when registering on the Site
In case you have chosen to store information about you on the Site by registering a profile on the same, we store the above data, as well as a history of orders made by each account registered on the Site. The required data matches those required when ordering. Along with them, we also process IP address, activity data (time and date of registration, acceptance of the Security Policy and General Terms and Conditions, account login, etc.);
Data provided when concluding other contracts
In cases where Lollipop enters into other contracts with individuals, other than distance selling, we require three names, social security number, address, email address.
Data provided by, through and on other websites and applications, called third parties
In certain cases, you may share information with social networks or use their sites to create your profile or link your profile on our website with the relevant social network. In this case, the social network may provide us with automatic access to certain personal information they have collected about you (e.g. the content you view, the content you want and information about the ads you have been shown or clicked on, etc. .n.). By linking your social network profile to your account on our website, you allow us to access your personal data processed by the relevant social network, and to collect, use and store this information in accordance with this Security Policy. This association of a social network profile with a registration on our website takes place in the event that you click on a link provided to create a Registration on our website by engaging in social media, thereby voluntarily establishing a link with the respective social media site media. In case you have chosen to register on our site through any social network, we may process your data such as names, telephone, email, gender, marital status, age, photo, education, place of birth, place of residence and other data that you have provided to these platforms and which are visible to us in case you log in with them on our site.
In case you provide your personal data to Lollipop through Viber, WhatsApp, Instagram, Facebook or any other platform/social network, we inform you that these platforms/websites/social networks have their own privacy policies and that we do not accept any responsibility or liability for these rules to the extent that their processing cannot be controlled by Lollipop. Therefore, we recommend that you check these policies before submitting your personal data to us through these websites/applications.
Data provided when posting a comment, review, publication
If you leave a post or comment on this website, your IP address will be saved, along with your names if you have entered this information. This is for the safety of the website operator. If your text breaks the law, it would like to be able to trace your identity. In addition, Lollipop has an obligation to store this data (referred to as "traffic") for certain periods and for certain purposes, as set out below. Due to the fact that sending comments, inquiries and other messages to the site, Facebook page/group or their administrators constitutes sending an electronic statement, according to the Law on Electronic Document and Electronic Authentication Services ("ZEDEUU"), the administrator has an obligation to maintain logs of the fact of sending the statement for a period of 1 year. The log contains the date of the statement, name and email address of the sender.
Employee data and data collected when processing job applications
We process data when concluding employment contracts and when evaluating and processing a job application. When concluding employment contracts, we require three names, social security number, address, age, gender, education data, work experience, bank data, and subsequently we also process health data. When processing resumes, we process names, address, e-mail address, age, gender, education, work experience, photo, data voluntarily provided by the candidate during an interview or in the resume.
Data provided in connection with correspondence, complaints and reports
In order to resolve submitted complaints, signals, disputes, inquiries, requests or other matters addressed in communication to Lollipop received through electronic forms on the Site, by calling Lollipop, by sending by regular or e-mail, Lollipop stores and processes this information , as well as the result of this processing. These can be names, email address, phone, address.
In addition, due to the fact that sending comments, inquiries and other messages to the site, the Facebook page or their administrators, constitutes the sending of an electronic statement, according to the Law on electronic document and electronic authentication services ("ZEDEUU") we have the obligation to maintain a log of the fact of sending the statement (without its content) for a period of 1 /one/ year. The log contains the date of the statement, the sender's name and email address, and the sender's identification.
If you provide us with personal information about someone else, you must do so only with that person's authorization. You must inform them of how we collect, use, disclose and store personal information in accordance with this Individual Privacy Policy.
Technical data collected in the course of using the Site
In addition, we collect information from your computer, phone, tablet or other device you use. This information may include the following:
● identifier of the device you are using, the type of that device and a unique identifier for that device, "log data" or “log data”, including information that your browser automatically sends to us when you visit a website; this log data includes the internet protocol address, the address and activity of the websites you visit, searches, browser type and settings, date and time of your request, how you used the site, cookie data and device data; if you would like to receive more details about the information we collect - contact us using the contact form.
● location information transmitted by the device if you have set it to display location data - note that mobile devices allow you to control or disable the use of location services by any application on your mobile device in the device's settings menu;
● computer and connection information, such as page view statistics, IP address, site browsing history, language settings, date and time;
● logs to facilitate your searches - quick links to repeat previous searches allow you to repeat your searches instead of entering them each time. The functionality can be used with or without registration. When using the Site, a cookie with a randomly generated number is stored in your browser, enabling the Site to show you quick links for repeating previous searches. The site stores and displays the last 10 searches associated with this browser, and when you log in to your account, you can save and use them in it. In case you use the Service with registration (currently an inactive feature), the last 10 searches are stored in your account;
● logs related to security, technical support, development, etc.:
- To ensure the reliable functioning of the services and to identify technical problems;
- To ensure the security of the services and detect malicious actions;
- To develop and improve the services on the site;
- To measure the site's attendance and usability;
- Logs in cases where this is required by law (such as logs of electronic declarations of will);
- Log for entering a user profile (account)
- this log makes it possible to establish and automatically block unregulated attempts to access accounts; it is maintained for a period of up to 1 /one/ year, containing the date and time of the account login, status, whether the login was through a mobile version, application or desktop browser, IP address;
- server logs, logs of security protection devices (Web Application Firewalls), etc. devices falling into this category. These logs are necessary to diagnose technical problems, detect malicious actions, etc. of the purposes stated above; they are stored for a period of up to 1 /one/ year. Logs may contain the following information: date and time, IP address, URL, browser and device information. In addition, some of the devices may use cookie-based security technology;
- cookies - the use of cookies is necessary for the functioning of the Site. In connection with this, a Policy on the use of cookies has also been adopted; read the Policy for more details about: the type of cookies we use, the term for their storage and use, etc.;.
We may prefer to reduce the amount of data we store and process according to the purposes of the processing.
We do not require and will not collect and process personal data that reveals: racial or ethnic origin; political, religious or philosophical beliefs; membership in trade union organizations; genetic and biometric data; data on the state of health, as well as data on sex life or sexual orientation. If a subject himself, on his own initiative and desire, provides such categories of data, then Lollipop is not responsible for the provision, but only undertakes to provide them with the same protection measures as are provided for the requested personal data. We do not transfer data to third countries. Also, we do not make automated decisions in relation to personal data and we do not process data of persons under 16 years of age. If you are under the age of 16, you should not provide us with personal data about yourself.
FOR WHAT PURPOSES WE PROCESS YOUR DATA
The main purpose for which WE process your personal data is generally related to the provision of services through the Site and social networks, namely the conclusion of a distance sales contract and the delivery of the goods and services ordered by you, as well as accounting of revenue. We also use your personal information to provide and improve our Services, provide you with a personalized experience on our site, contact you about your profile and our Services, provide you with customer service, provide you with personalized advertising and marketing according to your interests, to carry out raffles and games organized by us, and in certain cases to detect and investigate fraudulent or illegal activities.
Lollipop collects, uses and processes the information described above for the purposes set forth in this Policy, which may be related to:
• the conclusion of a contract for the purchase and sale of goods/services at a distance between you and Lollipop through the Site or social networks - we require your identification, contact and payment data in order to conclude a contract with you, respectively, to send you the order;
• conclusion of a consumer credit agreement when you have requested the purchase of a product or service from the Site through credit;
• processing payments and preventing fraudulent transactions (we may pass your data to a third party to perform these functions);
• conclusion of employment contracts and processing and evaluation of submitted resumes;
• protection and enforcement of the legitimate interests of other users of the Services, third parties and the Site - the legitimate interest pursues goals related to the legitimate interests of Lollipop and/or third parties. These goals include:
- detection and resolution of technical or functionality problems, development and improvement of the purpose of the Site;
- communicating with you, including electronically, on important issues related to the services provided by Us and the performance of concluded contracts;
- targeting our marketing, updating services and offering you promotional offers based on your preferences.
- receiving and processing received signals, complaints, requests and other correspondence;
- implementation and protection of the rights and legitimate interests of the Site, including by court order, and providing assistance in the implementation and protection of the rights and legitimate interests of other users of the site and/or affected third parties;
- administering the Website and Application and keeping them secure and safe;
- analyzing and improving the use of our website, app and retail, (including using information about how you navigate our website, App and/or stores;
- measuring and analyzing our advertising and sending you suggestions and recommendations based on the information you share with us;
- communicating with you about your account, troubleshooting your account. When we contact you by telephone, we may use automated or pre-recorded calls and text messages to ensure efficiency;
- informing you about products and services for which you wish us to send you information by e-mail, post, mobile phone and / or through other digital means (depending on your stated preferences), including social media platforms - only when we have received express consent from you for this;
• your registration on the Website (in which case We will also use your personal information to maintain and update your profile (for example, such as a change of address or a change in your marketing preferences);
• administer all contests/raffles/lottery-based games conducted by Lollipop;
• provide you with location-based services (such as advertising, search results and other personalized content);
• the performance of Lollipop's legal obligations, which includes:- fulfillment of obligations provided for in the law to preserve or provide information in view of our fiscal obligations to the state (for example, on the basis of the Accounting Act and other tax laws - VAT, ZDDFL, ZKPO, DOPK, etc.);- fulfillment of legal obligations based on the Labor Code, the Law on the Commercial Register and the Register of Non-Profit Legal Entities, etc. normative acts;- execution of an order received by us from competent state or judicial authorities (for example, on the basis of the Ministry of Internal Affairs, the Civil Procedure Code, the ZES);- fulfillment of obligations stipulated in the Regulation on the protection of personal data, related to notifying you of various circumstances related to your rights, to the Services provided and