Privacy Policy

Last updated on May 22, 2018

This updated Privacy Policy (“Policy”) regulates the personal data protection of individuals who use the site and the internet store at https://www.escreo.com (“Site”/”Internet store”), property of “3 EN 3” OOD (“Controller”). This Policy complies with the requirements of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“General Data Protection Regulation”/”GDPR”/”Regulation”), which enters into force on 25.05.2018, and the Bulgarian Personal Data Protection Act ("PDPA").

This Policy guarantees and complies with the following principles in relation to the processing of personal data:

1. “Principle of lawfulness, fairness and transparency” – personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject;

2. “Principle of purpose limitation” – personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes;

3. “Principle of data minimisation” – personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;

4. “Principle of accuracy” – personal data shall be accurate and, where necessary, kept up to date; every reasonable step is taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;

5. “Principle of storage limitation” – personal data is kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes provided that the appropriate technical and organisational measures in order to safeguard the rights and freedoms of the data subject are applied;

6. “Principle of integrity and confidentiality” – personal data shall be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures;

7. “Principle of accountability” - the Controller shall be responsible for, and be able to demonstrate compliance with the hereinabove principles.

I. DEFINITIONS

II. IDENTITY AND CONTACT DETAILS OF THE CONTROLLER AND CONTROLLER'S REPRESENTATIVE

III. CATEGORIES OF PERSONAL DATA THAT THE CONTROLLER PROCESSES

IV. PURPOSES OF THE PROCESSING OF THE PERSONAL DATA

V. LEGAL BASIS FOR THE PROCESSING OF PERSONAL DATA

VI. CATEGORIES OF RECIPIENTS OF PERSONAL DATA

VII. PERIOD FOR WHICH THE PERSONAL DATA WILL BE STORED

VIII. RIGHTS OF THE DATA SUBJECTS

IX. SECURITY OF THE PERSONAL DATA

I. DEFINITIONS

1.1. ”Personal data” means any information relating to an identified or identifiable natural person;

1.2. “Data subject” means an identifiable natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

1.3. “Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

1.4. “Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data;

1.5. “Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the Controller;

1.6. In this Policy, the European Union is referred to as the “Union”.

IDENTITY AND CONTACT DETAILS OF THE CONTROLLER AND CONTROLLER'S REPRESENTATIVE

2.1. Controller within the meaning of Art. 4, para. 7 of the Regulation and Art. 3, para. 1 of the PDPA and the present Policy is: “3 EN 3” OOD, UIC 203326551, represented by the manager Yasen Emilov Rusev;

2.2. The contact details of the Controller and Controller's representative are as follows:

2.2.1. Seat and address of management: Sofia, region “Iskar”, residence area “Drujba” 1, 25 “Tirana” str., entr. “C”, 5th floor, app. 110;

2.2.2. Exercise of activity address: Sofia Tech Park, Incubator Building, 1st floor, 111B Tsarigradsko shose;

2.2.3. Email: hello@escreo.com;

2.2.4. Phone: 0700 10 324.

III. CATEGORIES OF PERSONAL DATA THAT THE CONTROLLER PROCESSES

3.1. Upon an order, respectively conclusion of a distance contract, the Controller collects the following information constituting personal data of the natural persons, respectively the representatives of the legal entities, and namely:

3.1.1. Names;

3.1.2. Address;

3.1.3. Phone;

3.1.4. Email.

3.2. Upon request for a Newsletter, the Controller collects the following information constituting personal data of the natural persons, and namely:

3.2.1. Email.

IV. PURPOSES OF THE PROCESSING OF THE PERSONAL DATA

4.1. The data under Section III, item 3.1., and namely: names, address, phone and email are collected and processed for the following purposes:

4.1.1. Individualization of the clients of the Controller and performance of his obligations under the orders made and the distance contracts concluded;

4.1.2. Delivery of the ordered goods and services;

4.1.3. Sending of correspondence regarding the order made, respectively the distance contract concluded;

4.1.4. Connecting by phone or email regarding the order made, respectively the distance contract concluded;

4.1.5. Keeping of accountancy and complying with the requirements of the Accountancy Act and other regulations;

4.1.6.Sending newsletters for news and promotions for direct marketing purposes;

4.2. The data under Section III, item 3.2., and namely: email are collected and processed for sending newsletters for news and promotions for direct marketing purposes.

V. LEGAL BASIS FOR THE PROCESSING OF PERSONAL DATA

5.1. The Controller collects and processes the data under Section III, item 3.1., namely: names, address, phone and email, for the purposes under Section IV, item 4.1.1. - 4.1.5., and namely: individualization of the clients of the Controller and performance of his obligations under the orders made and the distance contracts concluded; delivery of the ordered goods and services; sending of correspondence regarding the order made, respectively the distance contract concluded; connecting by phone or email regarding the order made, respectively the distance contract concluded keeping of accountancy and complying with the requirements of the Accountancy Act and other regulations, on the grounds of Art. 6, para. 1, letter "b" of the Regulation, and namely processing is necessary for the performance of a contract to which the Data subject is party or in order to take steps at the request of the Data subject prior to entering into a contract.

5.1.1. If the Data subject does not provide his name, there is no possibility of concluding the distance contract.

5.1.2. If the Data subject does not provide his address, there is no possibility for the Controller to execute the distance contract, respectively to deliver the ordered goods and/or services.

5.1.3. If the Data subject does not provide his phone and email, there is no possibility for the Controller to confirm the order made, deliver the ordered goods and/or services, including to to a delivery company, and, when necessary, contact the Data subject regarding the execution of the order.

5.3. The Controller collects and processes the data under Section III, item 3.1.4. and item 3.2., namely: email, for the purposes under Section IV, item 4.1.6., and namely: sending newsletters for news and promotions for direct marketing purposes, on the grounds of Art. 6, para. 1, letter "a" of the Regulation, and namely the Data subject has given consent to the processing of his or her personal data for one or more specific purposes.

5.3.1. If the Data subject provides consent his or her data under item 5.3. to be processed for the direct marketing purposes, the latter agrees (with the right to withdraw his consent at any time) that the Controller may send him or her via email newsletters and other notices to inform him or her about promotions, campaigns, and news for the purposes of direct marketing and advertising of goods and/or services offered by the Controller. This shall be considered given consent under the meaning of Art. 6 para. 4 of the Electronic Commerce Act and art. 261, para. 1 of the Electronic Communications Act.

5.3.3. The Data subject may withdraw his consent under item 5.3. at any time, either by clicking the "unsubscribe from this list" button at the end of each email he/she has received, or by contacting the Controller at: hello@escreo.com or by calling: 0700 10 324.

VI. CATEGORIES OF RECIPIENTS OF PERSONAL DATA

6.1. The categories of recipients to whom personal data may be disclosed are:

6.1.1. persons, if provided for in a normative act, including state bodies, in respect of which there is a statutory requirement to provide certain categories of personal data;

6.1.2. Processors by virtue of a contract between the Controller and Processor, and namely, persons providing accounting services, IT services, the application services, marketing cooperation, advertising services, consultancy services, couriers, forwarders, carriers, auditors, lawyers, law firms, banks, as part of the refund procedure, etc., processing personal data only at the direction of the Controller, unless processing is required by current legislation; Processors are required to provide sufficient guarantees for the application of appropriate technical and organizational measures in such a way that the processing proceeds in accordance with the requirements of the Regulation and protect the rights of data subjects.

6.1.3. persons who, under the direct authority of the Controller, process personal data, have taken confidentiality commitment and are aware of the personal data legislation.

VII. PERIOD FOR WHICH THE PERSONAL DATA WILL BE STORED

7.1. Personal data is stored for a period of 5 years as of the last interaction of the Data subject with the Internet store, for example an order made via the Internet store or a visit made to the Internet store

VIII. RIGHTS OF THE DATA SUBJECTS

8.1. The Data subject shall have the right to obtain from the Controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:

8.1.1. the purposes of the processing;

8.1.2. the categories of personal data concerned;

8.1.3. the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;

8.1.4. the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;

8.1.5. the existence of the right to request from the Controller rectification or erasure of personal data or restriction of processing of personal data concerning the Data subject or to object to such processing;

8.1.6. the right to lodge a complaint with a supervisory authority;

8.1.7. where the personal data are not collected from the Data subject, any available information as to their source;

8.1.8. the existence of automated decision-making, including profiling.

8.2. The Controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the Data subject, the latter shall pay the administrative costs for the same. Where the Data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form.

8.3. The Controller provides the Data subject with the information under Art. 13 of the Regulation at the time of receiving the personal data, and namely with this Policy.

8.4. The Data subject shall have the right to obtain from the Controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the Data subject shall have the right to have incomplete personal data completed.

8.5. The Data subject shall have the right to obtain from the Controller the erasure of personal data concerning him or her without undue delay and the Controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

8.5.1. the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

8.5.2. the Data subject withdraws consent on which the processing is based and where there is no other legal ground for the processing;

8.5.3 the Data subject objects to the processing of personal data and there are no overriding legitimate grounds for the processing, or in cases where the processing is for the purposes of direct marketing, the processing of personal data for these purposes shall be terminated;

8.5.4. the personal data have been unlawfully processed;

8.5.5. the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the Controller is subject;

8.5.6. the personal data have been collected in relation to the offer of information society services directly to a child on the conditions applicable to the consent of a child in relation to information society services.

8.6. The Data subject shall have the right to obtain from the Controller restriction of processing where one of the following applies:

8.6.1. the accuracy of the personal data is contested by the Data subject, for a period enabling the Controller to verify the accuracy of the personal data;

8.6.2. the processing is unlawful and the Data subject opposes the erasure of the personal data and requests the restriction of their use instead;

8.6.3. the Controller no longer needs the personal data for the purposes of the processing, but they are required by the Data subject for the establishment, exercise or defence of legal claims;

8.6.4. the Data subject has objected to processing pending the verification whether the legitimate grounds of the Controller override those of the Data subject.

8.7. Where processing has been restricted under item 8.6., such personal data shall, with the exception of storage, only be processed with the Data subject's consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

8.8. A Data subject who has obtained restriction of processing pursuant to item 8.6. shall be informed by the Controller before the restriction of processing is lifted.

8.9 The Controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with item 8.4. – 8.8. to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it.

8.10. The Data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a Controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the Controller to which the personal data have been provided, where:

8.10.1. the processing is based on consent or on a contract; and

8.10.2. the processing is carried out by automated means.

8.11. In exercising his or her right to data portability pursuant to item 8.10., the Data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.

8.12. The exercise of the right referred to in item 8.10. shall be without prejudice to the right of erasure under item 8.5. That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller.

8.13. The Data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) of Article 6 (1) of the Regulation - when processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller, or based on point (f) of Article 6 (1) of the Regulation – when processing is necessary for the purposes of the legitimate interests pursued by the Controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the Data subject which require protection of personal data, in particular where the data subject is a child, including profiling based on those provisions. The Controller shall no longer process the personal data unless the Controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the Data subject or for the establishment, exercise or defence of legal claims.

8.14. Where personal data are processed for direct marketing purposes, the Data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.

8.15. Where the Data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.

8.16. At the latest at the time of the first communication with the Data subject, the right referred to in items 8.13.and 8.14. shall be explicitly brought to the attention of the Data subject and shall be presented clearly and separately from any other information.

8.17. The Data subject may exercise his or her right to object by automated means using technical specifications.

8.18. The Data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the Data subject shall be informed thereof.

8.19. Every Data subject has the right to lodge a complaint with the competent supervisory authority and before the competent courts of the Member States of his or her habitual residence, place of work or place of the alleged infringement if the Data subject considers that the processing of personal data relating to him or her is in breach of the provisions of the Regulation. The supervisory authority in the Republic of Bulgaria is the Commission for Personal Data Protection, address: Sofia 1592, 3 Prof. Tzvetan Lazarov Str., phone: 02 / 91-53-518, email: kzld@cpdp.bg, website: www.cpdp.bg.

8.20. The Controller shall take appropriate measures to provide any information and any communication under Section VIII, items 8.1. – 8.17. and Section IX, item 9.8. relating to processing to the Data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language. The information shall be provided in writing, or by other means, including, where appropriate, by electronic means. When requested by the Data subject, the information may be provided orally, provided that the identity of the data subject is proven by other means.

8.21. The Controller shall facilitate the exercise of Data subject rights under Section VIII, items 8.1. – 8.17.

8.22. The Controller undertakes to take all necessary action at the request of the Data subject for the exercise of his rights under Section VIII, items 8.1. - 8.17, and the Controller has the right to refuse only in cases where the Controller is unable to identify the Data subject.

8.23. The Controller shall provide information on action taken on a request under Section VIII, items 8.1. – 8.17. to the Data subject without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The Controller shall inform the Data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the Data subject makes the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by the Data subject.

8.24. If the Controller does not take action on the request of the Data subject, the Controller shall inform the Data subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.

IX. SECURITY OF THE PERSONAL DATA

9.1. The Controller has implemented appropriate technical and organisational measures to ensure that processing is carried out in accordance with the Regulation. These measures are reviewed periodically and, where necessary, updated.

9.2. The Controller has implemented appropriate technical and organisational measures designed to effectively enforce data protection principles, including data minimization, and integrating the necessary safeguards into the processing process to meet the requirements of the Regulation and ensure the protection of the Data subjects' rights.

9.3.The Controller has implemented appropriate technical and organisational measures to ensure that only personal data that is required for each specific processing purpose is processed by default. This obligation relates to the volume of personal data collected, the level of processing, the storage period and their availability. Such safeguards ensure that, by default, personal data is not available to an unlimited number of individuals by default.

9.4. The Controller has implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

9.4.1. the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;

9.4.2. the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident;

9.4.3. a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.

9.5. The Controller has taken steps to ensure that any natural person acting under the authority of the controller who has access to personal data does not process them except on instructions from the Controller, unless he or she is required to do so by Union or Member State law.

9.6. In the case of a personal data breach, the Controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the competent supervisory authority, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay.

9.7. The Controller shall document any personal data breaches, comprising the facts relating to the personal data breach, its effects and the remedial action taken.

9.8. When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the Controller shall communicate the personal data breach to the Data subject without undue delay.

9.9. The Controller does not perform automated decision-making and profiling.

If you believe that any information about you is false or inaccurate, please inform us as soon as possible.