“AMORE GELATI ” Ltd. takes due care to protect the personal data of the Customer, which became known when filling in the electronic form for registration and purchase on the web page www.amoregelati.bg. This obligation is waived if the Customer has provided false data.

Subject to applicable law and the provisions of these General Terms and Conditions, AMORE GELATI LTD may use the Customer’s personal data solely for the purposes set out in these General Terms and Conditions.

“AMORE GELATI ” Ltd. has the right to use the information provided by the Customer through the web page www.amoregelati.bg for offering goods and/or services to the Customer, for promotions, sending advertising messages, greetings, organizing raffles, inquiries, for statistical and any other lawful purposes, except in the case of express disagreement of the same sent to the following e-mail address: order@amoregelati.bg.

The purposes for which the data described above may be used are not exhaustive and do not give rise to any obligations for AMORE GELATI Ltd. through the www.amoregelati.bg website. Any other purposes for which the data is used will be in accordance with Bulgarian legislation, applicable international acts, Internet ethics, rules of morality and good morals.

By registering on the www.amoregelati.bg web page, the Customer agrees to receive personalised messages about promotions and up-to-date offers to the email address he/she entered when registering. In the event that the Customer does not wish to receive promotional messages, he/she may unsubscribe via a special embedded unsubscribe link contained in each promotional message.

“AMORE GELATI” Ltd., through the web page www.amoregelati.bg undertakes not to disclose any personal data about the Customer to third parties – state authorities, commercial companies, individuals and others, except in cases where:

has obtained the Customer’s express written consent;

the information has been requested by government authorities or officials who are authorized to request and collect such information according to the legislation in force;

“AMORE GELATI ” Ltd, through the web page www.amoregelati.bg is obliged to provide the information by law.

Mandatory information on individuals’ data protection rights. Information about the Data Controller Name “AMORE GELATI ” Ltd, UIC 206045981

Registered office and address of the registered office Sofia, ul. “Address for correspondence. Sofia, Nikolay Hayti Str. “00359 882 301293 E-mail: order@amoregelati.bg

Picture name: Tsvetanka Ivanova

Phone: 00359 882 301293

E-mail: order@amoregelati.bg

Name Commission for Personal Data Protection Headquarters and registered office Gr. 1592 Sofia Blvd. “Prof. 2 Tsvetan Lazarov Address for correspondence Gr. 1592 Sofia Blvd. “Prof. 2 Tsvetan Lazarov Phone 02 915 3 518 Website www.cpdp.bg

The controller collects and processes your personal data in connection with the use of the online store www.amoregelati.bg and the conclusion of contracts with the company on the basis of Article 6, paragraph 1, Regulation (EU) 2016/679 (GDPR), and in particular on the following grounds:

– Your explicit consent as a customer;

– Performance of the Controller’s obligations under a contract with you;

– Compliance with a legal obligation applicable to the Controller;

– For the purposes of the legitimate interests of the Controller or a third party;

We collect and process the personal data you provide to us in connection with your use of the www.amoregelati.bg online store and entering into a contract with the company, including for the following purposes:

– creating an account and providing full functionality when using the online store;

– individualisation of the contracting party;

– accounting purposes;

– information security protection;

– securing the performance of the contract for the provision of the relevant service;

– sending a newsletter if you so request;

(2) We observe the following principles in processing your personal data:

– lawfulness, fairness and transparency;

– limitation of the purposes of processing;

– relevance to the purposes of the processing and minimisation of the data collected;

– accuracy and timeliness of data;

– limitation of storage to achieve the purposes;

– integrity and confidentiality of processing and ensuring an appropriate level of security of personal data.

In processing and storing personal data, the Data Controller may process and store personal data in order to protect its following legitimate interests:

– Performance of its obligations to the National Revenue Agency, the Ministry of the Interior and other state and municipal authorities.

The Company carries out the following operations with the personal data provided by you for the following purposes:

Registration of a user in the e-shop and execution of a distance purchase contract – the purpose of this operation is to create a profile to use the e-shop for the purchase of goods and provide contact details for the delivery of purchased goods. The registration and creation of a profile for the use of the online shop is not a mandatory step of the provision of the service and it is available to a significant extent without the creation of a profile.

Impact assessment – Based on the impact assessment carried out, the Data Protection Officer considers that the operation “Registration of a user in the online shop and execution of a distance purchase contract” is admissible to carry out and provides sufficient guarantees to protect the rights and legitimate interests of data subjects in accordance with the requirements of the GDPR.

Sending newsletters (newsletter) and advertising messages – the purpose of this operation is to administer the process of sending newsletters to customers who have indicated that they wish to receive. Given the limited scope of the personal data collected, the Data Protection Officer considers that conducting an impact assessment is not necessary for the operation.

Exercising the right of withdrawal or making a complaint- the purpose of this operation is to administer the process of exercising the right of withdrawal or complaint by the customer. Given the limited scope of the personal data collected, the Data Protection Officer considers that conducting an impact assessment is not necessary to carry out the operation.

When paying for orders via a virtual POS terminal, AMORE GELATI Ltd. does not store data on the cards through which payments are made.

The controller processes the following categories of personal data and information for the following purposes and on the following grounds:

Purpose for which the data is collected:

1) To contact the user and send information to the user

2) For the purpose of registering a user in the online store, and

3) for the purpose of sending a newsletter.

Basis for processing your personal data – By accepting the terms and conditions and registering in the online store or placing an order without registration, or by concluding a written contract, a contractual relationship is established between the Controller and you, on the basis of which we process your personal data – Art. 6, para. 1 (b) GDPR. Your data for sending newsletters is processed on the basis of your explicit consent – Art. 6 para. 1 (a) GDPR.

Grounds for data processing. 1 (a) GDPR at the time of registration in the online store.

Delivery details (name, telephone, e-mail, address)

Purpose for which the data is collected: performance of the controller’s obligations under a distance purchase contract and delivery of the purchased goods, including when exercising the right of return or withdrawal from purchased goods.

Basis for processing your personal data- By accepting the terms and conditions and registering in the e-shop or placing an order without registration, or by concluding a written contract, a contractual relationship is established between the Controller and you, on the basis of which we process your personal data – Art. 6, para. 1 (b) GDPR.

(2) The Controller does not collect or process personal data relating to the following:

– reveal racial or ethnic origin;

– reveal political, religious or philosophical beliefs, or trade union membership;

– genetic and biometric data, data concerning health or data concerning sex life or sexual orientation.

(3) Personal data are collected by the Controller from the individuals to whom they relate.

(4) The Company does not carry out automated decision-making with data.

(5) The Company does not collect or process data about persons under the age of 18 except with the express consent of their parents or legal correspondents.

 The controller stores your personal data for a period no longer than the existence of your online store account or the completion of the order through the “Quick Order” option. After deletion of your account or successful completion, the Administrator shall take the necessary care to delete and destroy all your data without undue delay or to anonymize it (i.e. to put it in a form that does not reveal your identity).

The Controller shall keep your personal data provided in connection with online orders for a period of 5 years for the purpose of protecting the Controller’s legal interests in the event of legal or administrative disputes with users of the online shop, and the accounting documents shall be kept for the relevant statutory period.

The Controller shall notify you in the event that the data retention period needs to be extended in order to comply with a legal obligation or in view of the Controller’s legitimate interests or otherwise.

The Data Controller shall store the personal data of the legal representatives of its business partners for the duration of the performance of the contract, to comply with the legitimate interests and legal obligations of the Data Controller, which period may exceed the duration of the concluded contract.

The controller may, at its discretion, transfer some or all of your personal data to processors for the purposes of processing to which you have consented, subject to the requirements of Regulation (EU) 2016/679 (GDPR).

The controller will notify you in the event of an intention to transfer some or all of your personal data to third countries or international organisations.

Your rights in the collection, processing and storage of your personal data.

If you do not wish all or part of your personal data to continue to be processed by the Company for any or all of the processing purposes, you may withdraw your consent at any time by making a free text request to order@amoregelati.bg. You can download the form for withdrawal of consent to the processing of personal data HERE

The Data Controller may ask you to verify your identity and identity with the data subject by asking you to enter your email address and password to access the site on site at the Company’s office to an employee.

By withdrawing your consent to the processing of personal data, which is required to create and maintain an account in the online store, your account will become inactive. You will of course be able to browse the online shop and the products offered and place orders or make a new registration.

If you have placed an order that is in the process of being processed, the earliest you can withdraw your consent to processing is upon successful completion of the order.