"MILEN'S" LTD, UIC 131192973 is the owner of the online store www.mvhairshopy.com.

 "MILEN'S" LTD  is a limited liability company, registered in the Commercial Register at the Registry Agency with UIC 131192973, with its registered office and management address in the Republic of Bulgaria, Sofia 1407, Lozenets district, "James Bourchier" Blvd. № 95-97 ("MILEN'S" LTD hereinafter referred to as "Personal Data Controller" or simply "Controller"), represented by the Manager Milen Georgiev Vasilev.

The Controller "MILEN'S" LTD processes personal data of individuals for the purposes and periods specified below in this Policy.

The Controller complies with all provisions of the current Bulgarian and European legislation in the field of personal data protection in accordance with the Personal Data Protection Act and the GDPR - General Data Protection Regulation of the EU.

Contact details of "MILEN'S"  LTD:

Correspondence address: Sofia, postal code 1407, Lozenets district, "James Bourchier" Blvd. № 95-97.

Email address: info@mvsalon.bg

Contact phone: 02/944 4517

Contact person for personal data inquiries: Milen Vasilev

Contact person's phone number: 088 883 8908

Email address for personal data inquiries: info@mvsalon.bg

 

I. DEFINITIONS

"Personal data" according to these Rules means the personal data of individuals. According to the current Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as "GDPR") "personal data" means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number (UCN/PNF), location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

"Visitor" is any natural person and/or natural person, representative of a legal entity, who visits the website www.mvhairshopy.com.

"Processing of personal data" means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

II. Personal data processed by the Controller

Article 1. (1) Visitors of the website www.mvhairshopy.com can view all its sections and menus, navigate and search for information on it, without needing to enter any of their personal data. 

(2) If Visitors shop on the website www.mvhairshopy.com or by phone, regardless of whether through registration or without registration, they must provide the following minimally necessary information for the conclusion and execution of the purchase and sale agreement:

- first and last name;
- contact phone number;

- email address;

- delivery address;

 

(3) If it is necessary to refund sums to the Visitor paid to the Supplier in connection with the fulfillment of obligations under a concluded purchase and sale agreement, the Visitor will also need to provide:

- bank account details.

(4) When visiting the website www.mvhairshopy.com, the Controller automatically gains access to the following information about the Visitor:

- IP address;

- Date and duration of access;

- Amount of data transferred;

- Information about the browser and operating system you are using.

 

This information is collected by the Controller to improve website security, its functionalities, as well as for statistical and marketing research and direct marketing.

 

(5) The Controller does not collect or process "sensitive" personal data that reveals racial or ethnic origin of website visitors; reveals political, religious or philosophical beliefs, or trade union membership, as well as genetic and biometric data, data concerning health or data concerning a person's sex life or sexual orientation.

III. Grounds and purposes of processing

Article 2. (1) The personal data of Visitors are collected and processed by the Controller on the basis of:

- fulfillment of the Controller's obligations under the purchase and sale agreement;

- compliance with legal obligations applicable to the Controller (accounting, tax);

- explicit consent from the Visitor (in connection with an electronic newsletter; advertising; marketing research);

- the legitimate interest of the Controller (for the protection of the Controller's legitimate interests, e.g., in case of disputes between a Visitor and the Controller).

(2) Personal data are collected and processed by the Controller on the above-mentioned grounds, for the purposes of fulfilling its obligations under the contract with the visitors; communication with them; sending the electronic newsletter. 

IV. Methods and period of personal data processing

Article 3. The Controller processes personal data only for the purposes for which they were collected and in accordance with the principles of Article 5 of the GDPR through its employees.

Article 4. (1) The Controller transmits part of the data of Visitors who have ordered goods or services from the online store to the courier company for goods delivery "SPEEDY" AD for the purpose of fulfilling its obligations under the contract – to deliver the goods to the website Visitor.

(2) The Controller provides the minimally necessary data to the courier company, which it needs to provide the service of delivering the said shipment from "MILEN'S" LTD to the respective Visitor.

(3) The Controller provides personal data to the courier company only for individuals who have chosen the method of delivery of goods through the courier company "SPEEDY" AD.

(4) In the above cases, "SPEEDY" AD and "MILEN'S" LTD act as joint controllers with respect to the data that "MILEN'S" LTD has provided to "SPEEDY" AD.

Article 5. (1) The personal data of website Visitors are stored for the shortest possible periods by the Controller according to their category, and after this period expires, they are destroyed (deleted by the Controller).

(2) Personal data are processed for the following periods:

- data related to placed orders are stored for 5 years in connection with the accounting and financial obligations of the Controller, as well as in connection with the possible occurrence of disputes between a Visitor and the Controller;

- data from a personal profile – after the profile is deleted, the data are stored for another 2 years by the Controller, in connection with the possible occurrence of disputes between a Visitor with a profile and the Controller. To avoid any doubt, once the Visitor has chosen to delete the profile, it will no longer be accessible to the respective Visitor, and only the profile data will be stored;

- data provided in connection with receiving an electronic newsletter are deleted as soon as possible after a Visitor sends a request to no longer receive an electronic newsletter. They will not be stored by the Controller after the request is sent.

V. Recipients of personal data and third parties

Article 6. (1) Personal data may be disclosed to recipients of personal data – employees of the Controller, as well as persons with whom the Controller has a civil contract; lawyers; accountants. The disclosure of personal data is fully compliant with the requirements of the GDPR and Bulgarian legislation. 

(2) The recipients mentioned in paragraph 1 collect and process the personal data of visitors for the purposes determined by the Controller in connection with the performance of concluded purchase and sale agreements with visitors or in connection with the fulfillment of the Controller's legal obligations or in connection with the protection of the legitimate interests of the Controller.

(3) A third party to whom the Controller provides the personal data of visitors is the courier company for parcel delivery "SPEEDY" AD. The personal data of visitors are provided to "SPEEDY" AD only for the purposes of delivering the goods and services ordered by the visitors.

(4) The Controller also provides personal data to third parties – partners of the Controller who conduct marketing and statistical research. Personal data are provided to these persons for the purposes of marketing and statistical research, direct marketing, as well as to optimize the offering of products and services by the Controller.

Article 7. Apart from the recipients of personal data listed in Article 6, data may be provided to persons and authorities for whom the Controller has a legal obligation to disclose (e.g., Commission for Consumer Protection, Commission for Personal Data Protection, judicial and law enforcement authorities, NRA, etc.).

Your personal data will not be transferred to recipients based in third countries or international organizations.

VI. Visitor's Rights

1. Right of access.

This is the right of the Visitor to request from the Controller access to the personal data collected about him. Upon receipt of a request, the Controller will provide a copy of all data currently being processed for the respective visitor. The request for access to personal data can be submitted in oral or written form or by electronic means. In the request, the visitor must specify the format in which he wishes to receive the copy of the data. 

2. Right to rectification of personal data.

The data subject has the right to request from the Controller to rectify without undue delay inaccurate personal data relating to the visitor – this includes incomplete personal data to be completed, including by means of providing a supplementary statement, taking into account the purposes of the processing. 

3. Right to erasure of personal data.

The Visitor has the right to request from the Controller the erasure of personal data when one of the grounds specified in Article 17, paragraph 1 of the GDPR exists, for example: personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed, also the visitor may withdraw a given consent for processing, may withdraw his consent for the processing of personal data, when the Controller has no legal grounds to continue processing, including when the visitor considers that the personal data has been unlawfully processed by the Controller.

4. Right to restriction of processing of personal data.

The Visitor has the right to request restriction of the processing of personal data by the Controller on the grounds specified in Article 18, paragraph 1 of the GDPR through an oral or written request, and also by electronic means. 

5. Right to object to the processing of personal data.

The Visitor has the right to object to the processing of his personal data.

6. Right to data portability.

If personal data are processed based on explicit consent or on a contractual obligation for processing and if the processing is carried out by automated means (i.e. through automated electronic systems, and not in the form of a paper archive), the Visitor has the right to data portability. In this case, the visitor can request from the Controller to transfer part or all of his processed personal data to another controller. The right to portability, according to Article 20 of the GDPR, includes two elements: firstly, the right of the visitor to receive the personal data concerning him, which he has provided to the controller, in a structured, commonly used and machine-readable format, secondly - the right of the visitor to request the transfer of these personal data to another controller.

7. Right to withdraw consent for processing personal data.

The Visitor has the right to withdraw his consent for the processing of his personal data, given with a Consent Declaration. Subsequent withdrawal will not affect the lawfulness of processing carried out up to that point based on the previously given consent.

8. Right to lodge a complaint with a competent supervisory authority.

The Visitor has the right to lodge a complaint with the competent supervisory authority, namely:

 Commission for Personal Data Protection /CPDP/ 

Correspondence address: Sofia, postal code 1592, "Prof. Tsvetan Lazarov" Blvd. № 2, 

Contact phone: 02/915 35 18, 

Email:  kzld@cpdp.bg; 

Website: www.cpdp.bg 

 

VIII. Other

The website contains links to other web pages that are owned by other personal data controllers. "MILEN'S" LTD is not responsible for the method of collecting and processing personal data of visitors by these other web pages, if the Visitor follows the link from the website.

The Controller does not carry out automated decision-making, including profiling in connection with the processed personal data.

IX. Updates

The Controller has the right to update this Policy, and Visitors are obliged to monitor for updates on the website www.mvhairshopy.com

 

This Data Protection Policy was adopted by "MILEN'S" LTD on 06.09.2021 and comes into force for all Visitors of the website www.mvhairshopy.com on 06.09.2021.