Information regarding the Personal Data Controller:
Name: MultiNutra OOD
Unified Identification Code (UIC): 208730245
Registered Office and Management Address: Sofia, 71 Andrey Lyapchev Blvd., 3rd floor
Correspondence Address: Kyustendil, Studen Kladenets St., Building 1, Ground Floor, Unit 4
Phone: 0882523322
E-mail: hello@dimashealthy.com
Information regarding the competent supervisory authority:
Name: Commission for Personal Data Protection of the Republic of Bulgaria
Registered office and management address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592. Correspondence address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592.
Telephone: 02 915 3 518
Website: www.cpdp.bg
MultiNutra Ltd. conducts its activities in compliance with the Personal Data Protection Act and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
Legal basis for the collection, processing, and storage of your personal data
Art. 1. The Controller collects and processes your personal data pursuant to Article 6, paragraph 1 of Regulation (EU) 2016/679, specifically on the following grounds:
– Explicit consent provided by you, as a user of the service/customer, by confirming the consent form when finalizing an order during a purchase from our online store.
– Explicit consent provided by you, as a user of the service/customer, to one of our representatives via telephone when placing an order by phone. – Explicit consent obtained from you, as a user of the service/client, when placing an order via email. By sending an order to the online store at the email address designated for this purpose, you provide your explicit consent to this!
Objectives and Principles for the Collection, Processing, and Storage of Your Personal Data
Art. 2. (1) The Controller collects and processes the personal data that you provide for the purpose of fulfilling contractual obligations, including for the following purposes:
– accounting purposes
– ensuring the performance of the contract for the provision of the relevant service
(2) The Controller adheres to the following principles when processing your personal data:
– lawfulness, fairness, and transparency
– purpose limitation
– data minimization (relevance to the purposes of processing and limiting the data collected)
– accuracy and currency of the data
– storage limitation (retaining data only as long as necessary to achieve the purposes)
– integrity and confidentiality of processing, and ensuring an appropriate level of security for personal data
(3) In the course of processing and storing personal data, the Controller may process and store such data for the purpose of protecting the following legitimate interests:
– Fulfillment of obligations toward the National Revenue Agency, the Ministry of Interior, and other state and municipal authorities.
What types of personal data does the Controller collect, process, and store?
Art. 3. (1) The Controller performs the following operations with personal data for the following purposes:
– processing of a product order – the purpose of this operation is the acceptance of an order and the delivery of the product from the online store to the end customer.
(2) The Controller processes the following categories of personal data and information for the following purposes:
– Your identifying data – name, address, email address, and telephone number – for the purposes of accepting an order and delivering the product from the online store to the end customer.
Retention Period for Your Personal Data
Art. 4. (1) The Controller shall retain your personal data for a period not exceeding 30 days. Upon the expiry of this period, the Controller shall take the necessary measures to delete and destroy all your data without undue delay.
(2) The Controller shall notify you in the event that the data retention period needs to be extended for the purposes of fulfilling the stated objectives, executing a contract, safeguarding the legitimate interests of the Controller, or for other reasons.
Transfer of Your Personal Data for Processing
Art. 5. (1) The Controller may, at its own discretion, transfer some or all of your personal data to personal data processors for the purpose of carrying out processing activities, in compliance with the requirements of Regulation (EU) 2016/679.
(2) The Controller shall notify you of any intention to transfer some or all of your personal data to third countries or international organizations.
Your Rights Regarding the Collection, Processing, and Storage of Your Personal Data
Right of Access
Art. 6. (1) You have the right to request and obtain from the Controller confirmation as to whether personal data concerning you is being processed.
(2) You have the right to access the data, as well as information regarding the collection, processing, and storage of your personal data.
(3) Upon request, the Controller shall provide you with a copy of the personal data concerning you that is being processed, in an electronic or other suitable format.
(4) Access to the data is provided free of charge; however, the Controller reserves the right to impose an administrative fee in the event that requests are repetitive or excessive.
Right to Rectification or Completion
Art. 7. You have the right to request that the Controller:
– rectify inaccurate personal data concerning you;
– complete incomplete personal data concerning you.
Right to Erasure (“Right to be Forgotten”)
Art. 8. (1) You have the right to request that the Controller erase personal data concerning you, and the Controller is obliged to erase such data without undue delay if any of the following grounds apply:
– the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
– you withdraw the consent on which the processing is based, and there is no other legal ground for the processing; – You object to the processing of personal data relating to you, including for the purposes of direct marketing, and there are no overriding legitimate grounds for the processing;
– the personal data have been processed unlawfully;
– the personal data must be erased in order to comply with a legal obligation under EU law or the law of a Member State to which the Controller is subject;
– the personal data have been collected in relation to the offer of information society services.
(2) The Controller is not obliged to erase the personal data if they are stored and processed:
– for exercising the right of freedom of expression and information;
– for compliance with a legal obligation requiring processing under EU law or the law of a Member State to which the Controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller;
– for reasons of public interest in the area of public health;
– for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes;
– for the establishment, exercise, or defense of legal claims.
Right to restriction
Art. 9. You have the right to request that the Controller restrict the processing of data relating to you when:
– you contest the accuracy of the personal data, for a period enabling the Controller to verify the accuracy of the personal data; – the processing is unlawful, but you do not wish for the personal data to be erased, requesting instead that its use be restricted;
– the Controller no longer requires the personal data for the purposes of processing, but you require it for the establishment, exercise, or defense of legal claims;
– you have objected to the processing, pending verification of whether the Controller’s legitimate grounds override your own interests.
Right to Data Portability
Art. 10. If you have provided consent for the processing of your personal data, or if the processing is necessary for the performance of a contract with the Controller, or if your data is processed by automated means, you may—upon verifying your identity to the Controller—do the following:
– request that the Controller provide you with your personal data in a readable format, allowing you to transfer it to another Controller;
– request that the Controller transfer your personal data directly to another controller specified by you, where technically feasible.
Right to Receive Information
Art. 11. You may request that the Controller inform you of all recipients to whom the personal data—for which rectification, erasure, or restriction of processing has been requested—has been disclosed. The Controller may refuse to provide this information if doing so would prove impossible or require a disproportionate effort.
Right to Object
Art. 12. You may, at any time, object to the processing of your personal data by the Controller, including where such processing is carried out for the purposes of profiling or direct marketing.
Your Rights in the Event of a Personal Data Breach
Art. 13. (1) If the Controller discovers a personal data breach that is likely to result in a high risk to your rights and freedoms, they shall notify you of the breach without undue delay, as well as of the measures that have been taken or are to be taken.
(2) The Controller is not required to notify you if:
– they have implemented appropriate technical and organizational protection measures regarding the data affected by the security breach;
– they have subsequently taken measures ensuring that the breach is no longer likely to result in a high risk to your rights;
– such notification would involve disproportionate effort.
Recipients of Your Personal Data
Art. 14. For the purposes of processing your personal data and providing the service, the Controller may disclose the data to the following entities, acting as data processors:
– Speedy AD
– Econt AD
– DHL
The aforementioned data processors comply with all legal and security requirements regarding the processing and storage of your personal data. For a user who wishes to delete their data from the website https://bg.dimashealthy.com/