Privacy policy

Privacy Policy

PACHNIKOV 01 EOOD
(Notice on the processing of personal data)

Data controller

  1. Name: PACHNIKOV 01 EOOD
  2. UIC: 205994706
  3. Registered office and address: 79 Hristo Botev Blvd, Sofia, Bulgaria
  4. Phone: +359896880968
  5. Email: contact@skinfleek.com
  6. Website: skinfleek.com

PACHNIKOV 01 EOOD (the "Company" or the "Controller") carries out its activities in accordance with the Bulgarian Personal Data Protection Act and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (the "General Data Protection Regulation", "GDPR" or the "Regulation"). This Privacy Policy (the "Policy") informs every Customer (as defined below) of the Company about how we process data that identifies, or can be used to identify, that Customer.

For the purposes of this Policy, a "Customer" is any natural person who is a party to a contract with the Company for the purchase of goods, any natural person who has expressed a wish to enter into pre-contractual relations with the Controller, and any user of the Online Shop. It also includes any director, manager, representative, authorised agent, employee, partner, shareholder or beneficial owner of a legal entity or other legal arrangement that uses the Online Shop.

This Policy applies to the Skinfleek online shop at skinfleek.com, including the EU website at skinfleek.com/en-eu (the "Online Shop").

1. What personal data do we process?

As a data controller, the Company processes the following categories of Customers' personal data:

  • Physical identity: name, address, phone number, email address;
  • Economic identity: bank account information.

The Controller collects personal data directly from the persons the data relates to.

2. How do we collect personal data?

We collect personal data:

  • when you register on the Online Shop website, and when you use the Online Shop without registering;
  • when we correspond with you, which may include written communication (including electronic communication) and oral communication;
  • through cookies when you use or browse our website.

In some cases we may also collect information from third parties or from public sources.

Our website collects data in log files. This information includes your IP address, internet service provider, the browser you use, your operating system, when you visited our website and which pages you visited.

Our website uses cookies. Cookies are small files with information that a website sends to a visitor's browser. The browser stores this information in a text file on the user's device. Cookies help us make our website work better for you. You can read more about how we use cookies in our Cookie Policy, published on the Online Shop website at skinfleek.com.

3. Do we process special categories of personal data?

The Company does not process special categories of Customers' personal data.

4. For what purposes do we process personal data?

The Company processes Customers' personal data for the following purposes:

  • to provide information and assistance that you have requested from us;
  • to identify and contact customers and beneficial owners;
  • for all activities related to the existence, amendment and termination of the relationship between the Company and the Customer;
  • to offer and promote additional services;
  • to comply with regulatory requirements;
  • to defend our rights in case of a dispute and to cooperate with regulatory authorities to the extent required by law.

If we do not process this personal data, we may not be able to provide our services or the assistance you have requested.

5. On what legal basis do we process personal data?

We collect, process and use Customers' personal data on the basis of several legal grounds:

  • for the performance of a contract or to take steps before entering into a contract;
  • to comply with a legal obligation that applies to the Company;
  • for the legitimate interests of the Company or a third party, where the rights and interests of the data subjects do not override them: to resolve disputes; to prevent, detect and investigate fraud, violations or other unlawful conduct; and to establish, exercise or defend legal claims;
  • on the basis of freely given consent, where this is required by applicable law.

6. How long do we keep personal data?

The Company keeps personal data for the duration of the contractual relationship, until all claims under the contract have been settled, and for a transitional period afterwards (for example, to meet obligations for archiving and storing accounting records). If court or other proceedings are started, personal data may be kept until the end of those proceedings, including any possible appeal periods, and will then be deleted or archived as permitted by applicable law. In particular, accounting and tax records that contain personal data are kept for 10 years, starting from 1 January of the year following the reporting period they relate to.

Where we have received and process your personal data on the basis of your consent, we will process it only for as long as we have your consent.

7. Who do we share personal data with? Do we transfer it to third countries?

The Company may, at its own discretion, transfer some or all personal data to data processors in order to achieve the purposes of processing, in compliance with the requirements of the Regulation.

The Company shares personal data with:

  • third parties: service providers that we engage to carry out functions or activities on our behalf (for example, our online shop platform, payment providers and delivery companies);
  • third parties: regulatory authorities, tax and financial authorities, courts, administrative and law enforcement authorities, all in accordance with applicable law.

This list is not exhaustive, and there may be other lawful purposes for storing, disclosing or otherwise processing your personal data.

The Company will inform the data subject if it intends to transfer some or all of their personal data to third countries or international organisations.

8. Is personal data protected?

The Company applies and maintains appropriate technical and organisational measures to protect personal data against unauthorised access or unlawful use, and against accidental loss, alteration, disclosure, access, damage or copying. These measures are designed to ensure the continued protection and confidentiality of personal data. The Company reviews these measures regularly to keep personal data secure at all times.

9. Do we use automated decision-making?

The Company does not carry out automated decision-making based on personal data.

10. What are Customers' rights regarding the protection of personal data?

Every Customer can exercise the rights below by sending a written message to the Company, for example by email to contact@skinfleek.com.

Right to withdraw consent

Where the processing of a Customer's personal data is based on the Customer's consent, the Customer has the right to withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of processing based on consent before it was withdrawn.

Right of access

Every Customer has the right to get confirmation from the Company as to whether the Company processes their personal data. This includes the right to access the personal data, the right to receive a free copy of the data (except in the case of excessive or repeated requests), unless otherwise provided by the applicable data protection rules, and the right to receive a description of the main information related to the processing of their personal data.

The Company provides the Customer with a free copy of the personal data being processed, but reserves the right to charge an administrative fee for repeated or excessive requests.

Right to rectification

Every Customer has the right to correct, or to ask the Company to correct without undue delay, any inaccurate, incomplete or outdated personal data about them.

Right to erasure (the "right to be forgotten")

Every Customer has the right to ask the Company to erase their personal data without undue delay where one of the following grounds applies:

  1. the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
  2. the Customer withdraws the consent on which the processing is based, and there is no other legal ground for the processing;
  3. the Customer objects to the processing, as described below;
  4. the Customer's personal data has been processed unlawfully;
  5. the Customer's personal data must be erased to comply with a legal obligation under EU law, the law of a Member State or the law of another country;
  6. the personal data was collected in connection with the offer of information society services.

The Company may refuse to erase a Customer's personal data to the extent that processing is necessary:

  1. for exercising the right of freedom of expression and information;
  2. to comply with a legal obligation under EU or Member State law that applies to the Controller, or to perform a task carried out in the public interest or in the exercise of official authority vested in the Controller;
  3. for reasons of public interest in the area of public health;
  4. for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes;
  5. for the establishment, exercise or defence of legal claims.

Right to restriction of processing

Every Customer has the right to ask the Company to restrict the processing of their personal data in the following cases:

  1. when the Customer contests the accuracy of the personal data provided by the Customer and processed by the Company (the restriction applies for a period that allows the Company to check the accuracy of the data);
  2. when the processing is unlawful, but the Customer does not want the personal data to be erased and asks for its use to be restricted instead;
  3. when the Company no longer needs the personal data for the purposes of processing, but the Customer needs it for the establishment, exercise or defence of legal claims;
  4. when the Customer has objected to the processing and is waiting for the Company to check whether the Company's legitimate grounds for processing override the Customer's interests.

Right to object

Every Customer has the right to object at any time, on grounds relating to their particular situation, to the processing of personal data about them.

The Customer can exercise this right only for processing of their personal data that the Company carries out for the purposes of the Company's legitimate interests.

If the objection is justified, the Company will stop processing the personal data of that Customer, unless the Company shows compelling legitimate grounds for the processing that override the Customer's interests.

Where we use your personal data for direct marketing, you can object to this at any time, and we will then stop using your data for that purpose. You can also unsubscribe from our marketing emails at any time using the link in each email.

Right to data portability

This right includes the following options:

  1. to receive the personal data in a structured, commonly used and machine-readable format, so that it can be transferred to another controller; or
  2. to have the personal data transferred directly to another controller, where technically possible.

Right to lodge a complaint

Every Customer has the right to lodge a complaint about the processing of their personal data by the Company with the Commission for Personal Data Protection, which is the competent supervisory authority:

Commission for Personal Data Protection (Komisia za zashtita na lichnite danni, CPDP)
Address: 2 Prof. Tsvetan Lazarov Str., 1592 Sofia, Bulgaria
Phone: +359 2 915 3519, fax: +359 2 915 3525
Email: kzld@cpdp.bg
Website: www.cpdp.bg

Under the GDPR, you may also lodge a complaint with the data protection supervisory authority in the EU Member State where you live, where you work or where the alleged infringement took place.

11. What happens if this Policy changes?

If there is a significant change in the way the Company processes Customers' personal data, in the types of personal data it processes, or in any other aspect covered by this notice, the Company will inform Customers of the change without delay by issuing and providing an updated version of this notice.