Privacy Policy

PRIVACY POLICY

Privacy Notice

Information about the company processing customers’ personal data in the platform:

Name: SAINT MARTEN ECOLIFESTYLE OOD is a company with headquarters and registered address in the Republic of Bulgaria, city of Ruse, 71 Aleksandrovska Street, 1st floor, Unified Identification Code 206609992, correspondence address: Ruse, 71 Aleksandrovska Street, 1st floor, telephone: 082 871 741, e-mail: Hello@saintmarten.com

Competent personal data protection supervisory authority:

Name: Commission for Personal Data Protection

Headquarters and registered address: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.

Correspondence address: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.

Telephone: 02 915 3 518

Website: www.cpdp.bg

SAINT MARTEN ECOLIFESTYLE OOD (also referred to as “Data Controller”, “the Company”, “Trader” or “Saint Martén” in this privacy notice) operates in accordance with the Personal Data Protection Act and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

 The purpose of this notice is to inform the users of the online shop https://saintmarten.com/ about all actions related to the processing of their personal data and about their rights in relation to the processing of such data.

Ground for the collection, processing and storage of personal data related to the use of the online shop (website, platform) https://saintmarten.com/

Art. 1. The Controller processes personal data of their customers based on the following grounds:

– compliance with the company obligations under distance sales contracts with the customers;

 – the explicit consent given by the customer;

– compliance with a legal obligation to which the controller is subject;

– the legitimate interests pursued by Saint Martén or a third party.

Purposes of the customers’ personal data processing and storage

Art. 2. (1) Saint Martén collects, processes and stores the customers’ personal data in relation to the use of the online shop for the following purposes:

Purposes of processing and ground

  • Profile creation and ensuring full functionality when using the platform;

Ground:

1. Consent given by the customer by the registration of a profile, accompanied by active operations;

2. Contractual relation between the customer and the controller for the purpose of buying goods.

  • Conclusion and performance of a distance sale contract;

Ground: Contractual relation between the customer and the controller for the purpose of buying goods and performance of the company obligations under this contractual relation.

  • Identification of a party to a contract;

Ground: Compliance with the company obligations under distance sales contracts with the customer.

  • Accounting, analytical and statistical purposes;

Ground:

1. The legitimate interests of the company;

2. Compliance with a legal obligation to which the controller is subject;

3. The explicit consent given by the customer.

  • Protection of information security;

Ground:

1. The legitimate interests of the company;

2. Compliance with a legal obligation to which the controller is subject.

  • Ensuring compliance with the contract for provision of the respective service;

Ground:

1. The legitimate interests of the company;

2. Contractual relations for the purpose of purchasing goods.

  • Sending a newsletter if the customers have expressed their willingness to receive such newsletter.

Ground:  The explicit consent given by the customer.

 (2) The Controller may process and store the customer’s personal data for the purpose of complying with their obligations toward the National Revenue agency, the Ministry of Interior and other state and municipal authorities.

The types of customer personal data categories to be processed

Art. 3 (1) The company collects and processes 2 main groups of personal data for the purpose of the customer’s use of the online shop and conclusion of a distance sales contract.

  1. Identifying data (e-mail, name, address, telephone, IP address, etc.)

Purpose for data collection and ground:

A) Conclusion and performance of a distance sale contract and identification of a party to a contract;

Ground for processing: Every user that uses the online shop and buys goods agrees with the general terms and/or concludes a distance sales contract. For the purpose of performing the contract, identifying the parties and establishing of the user’s identity, certain personal data need to be collected. The contractual relation that has been established between the parties is a ground for collection of the customer’s personal data.

B) User registration in the online shop for the purpose of creating a profile or for the purpose of buying goods without using a profile;

Ground for processing: Each user may purchase goods, irrespective of having a profile or not, at their will. The creation of a profile and maintaining that profile requires data collection. These are the same data used for orders placed by customers with no registration and the information collected is limited to what is necessary for performance of the distance sales contract. The main ground for data collection for this purpose is the explicit consent given by the customer by performing active operations for profile registration or by filling in a form for placing an order when the customer shops without registration. To create a profile or purchase goods without registration, the customer needs to accept the general terms. This gives rise to a contractual relation between the customer and the controller, which is an additional ground for processing.

C) For sending a newsletter;

Ground for processing: The data for this purpose are processed on the ground of consent given by the customer. The latter explicitly agrees and confirms by active operations that they want to receive a newsletter by filling in a form or by contacting the trader at the contact details indicated in the online shop.

D) Protection of information security;

The company uses customers’ personal data for the purpose of ensuring the security of the shop and users against cyber attacks; the controller undertakes measures to prevent and detect any attempts for fraud;

Ground for processing: Pursuing the controller’s legitimate interest.

E) Accounting and statistical purposes.

The company may use the customer’s personal data for the purpose of complying with the controller’s legal obligation to keep accounts, as well as for the purpose of analyses and statistical forecasts.

Ground for processing: Compliance with a legal obligation to which the controller is subject or an explicit consent given by the customer.

  • Shipping details (full name, telephone number, address, etc.)

Purpose for data collection:

A) Ensuring compliance with the contract for provision of the respective service.

The customer’s data are processed for the purpose of compliance with the company’s obligation within the meaning of the general terms and the distance sales contract, as well as for delivery of the purchased goods.

Ground for processing: Contractual relation between the company and the customer arising based on the general terms and the distance sales contract concluded.

 (2) The controller does not collect or process personal data that:

– disclose the racial or ethnic origin;

– disclose the political, religious or philosophical beliefs or membership in trade associations;

– disclose genetic and biometric data, data concerning health or data concerning sex life or sexual orientation.

(3) The company does not perform automated decision-making with personal data.

What types of operations (actions) are undertaken with the customers’ personal data?

Art. 4 (1) The company may perform the following operations with customers’ personal data, listed by way of example:

–             User registration in the platform and performance of a distance sale contract;

 The purpose of this operation is to create a user profile, thus allowing the user to use the platform, purchase goods and customize the online shop based on their preferences. For this purpose, contact details have to be provided in order to provide shipping for goods ordered/purchased from the company, as well as data that allow the user to identify themselves as a subject different from the other ones. The registration and creation of a profile for using the website is not a mandatory step for purchasing a good and this operation is accessible even without creating a profile. Registration takes place at the discretion of the user.

–             Conclusion and performance of contracts for purchasing a product from the online shop;

The purpose of this operation to enter into a relationship with a user purchasing goods from the company’s internet shop, as well as compliance with the trader’s obligations under this relationship.

–             Sending a newsletter;

The purpose of this operation with personal data is to create an opportunity for sending a newsletter to the customers that have declared that they are willing to receive such newsletter.

–             Exercising the right to refusal;

The purpose of this operation is administration of the process of exercising the right to refusal or return by the customer.

(2) When processing your personal data, we comply with the following principles:

Principles of processing

–             lawfulness, fairness and transparency;

–             processing purpose limitation;

–             relevance to the processing purpose and minimization of the data collected;

–             accuracy and up-to-date status of the data;

–             storage limitation with a view to achieving the purposes;

–             integrity and confidentiality of processing and ensuring appropriate security of the personal data.

Art. 5.  The controller may use the so-called functional “cookies” for the purpose of using the website, which are necessary for the proper functioning of the website, for improving the user experience, for statistical purposes, easy access. etc. and by using the trader’s online shop, the customer agrees to that use.  The customer may control and/or delete the “cookies” at any time by using the settings of the browser they use. Most “cookies” do not constitute personal data and are not used for identification of the online shop visitors and users.

Customers’ personal data storage period

Art. 6. (1) The controller shall retain the customers’ personal data for a period no longer than the period of existence of the user profile in the online shop. If the customer decides to delete the profile they have created, the controller will delete and destroy all personal data of that customers without undue delay and will anonymize them (i.e. transform them into a form that does not disclose the user’s identity).

(2) The controller shall process personal data provided by the customer when placing an order without registration in the online shop until finalization of the order, unless the customer explicitly agrees that these data may be processed for the purpose of improving the platform, providing customized terms, promotions, as well as statistical purposes.

(3) The controller shall retain the customers’ data provided in relation to online orders placed for a period of 5 years for the purpose of protecting the legitimate interests of the controller in the case of judicial or administrative disputes with users of the online shop.

(4) The controller shall notify the customers that the storage period for their data may be extended with a view to complying with a statutory obligation or with a view to the controller’s legitimate interests or other statutory requirement.

Transfer of customers’ personal data for processing to other parties

Art. 7.  The controller may transfer all or part of the customers’ personal data to third party processors at their discretion for complying with the processing purposes the customers have consented to, provided that the requirements of Regulation (EU) 2016/679 (GDPR) are complied with.

Withdrawal of consent for personal data processing

Art. 8. (1) If the customer does not want their personal data to be processed by the company for marketing purposes, surveys and/or receiving a newsletter, they can withdraw their consent for processing at any time by filling in the form for withdrawal of consent in Annex No. 1 of this notice or by sending a free-text request to do so via e-mail.

(2) The withdrawal of consent shall not reflect on the lawfulness of the personal data processing the controller has performed up to that time.

Art. 9. The customer shall have the following rights as a data subject:

Right of access – the customer shall have the right to receive a confirmation from the trader that their personal data are processed and to request and receive information about the purpose of the processing, the categories of personal data processed, the recipients, the sources, the envisaged storage period, the right of complaint to a supervisory authority and the presence of automated decision making, including profiling.

Right of rectification – the customer shall have the right to request rectification (without undue delay) of inaccurate personal data concerning them. The customer shall have the right to request completion of incomplete data.

Right to erasure – the customer shall have the right to request erasure of their personal data when these are no longer necessary in relation to the purposes for which they were collected and processed. The customer shall have the right to withdraw their consent or object to the processing, if the trader does not have any other legal ground for the processing. If the user’s personal data are processed unlawfully, the customer may request the erasure of these data. 

Right to restriction of processing – the customer shall have the right to request restriction of processing where the accuracy of the personal data is contested. The restriction is applied for a period that allows verification of the data accuracy. The customer shall have the right to restriction of processing if the processing is unlawful. The customer shall have the right to restriction if they have objected to the processing and expects an inspection on the legal grounds for the continued processing.

Right to data portability – where the personal data processing is based on a consent or performance of a contractual obligation and is performed in an automated way, the customer shall have the right to receive, without hindrance, the personal data concerning them that they have provided to the company for the purpose of transmitting those data to another controller.

Right to object – the customer shall have the right to object to the processing, including profiling, of personal data concerning them, where such processing is outside the scope of the lawful purposes.

Right of complaint – the customer shall have the right to lodge a complaint to the Commission for Personal Data Protection for breach of their rights within one year of becoming aware of the breach, however, no later than 5 (five) years of that breach. Where the rights of the consumer have been violated, the latter may also oppose to the deeds and actions of the company before the competent court.

Art. 10. (1) The controller shall not perform personal data transfers to third countries.

(2) The controller will notify the customer if they decide to transfer all or part of the personal data to third countries or international organizations.

Art. 11. In case of a violation of the customers’ rights under the applicable personal data protection legislation, each consumer shall have the right to lodge a complaint to the Commission for Personal Data Protection:

Name: Commission for Personal Data Protection.

Headquarters and registered address: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.

Correspondence address: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.

Telephone: 02 915 3 518

Website: www.cpdp.bg

Changes and updates

This notice complies with the relevant European and national legal framework in the area of personal data protection. In the case of changes to the notice, information will be provided, which will be available on the online shop of the trader.

Annex No. 1

Personal Data Processing Consent Withdrawal Form

Name: …………………….

E-mail you have used in the online shop: …………………….

Telephone:

Contact details (e-mail): …………………….

Attn:

Name: SAINT MARTEN ECOLIFESTYLE OOD

Unified Identification Code/BULSTAT: 206609992

 Republic of Bulgaria, city of Ruse, 71 Aleksandrovska Street, 1st floor

Headquarters and registered address: Republic of Bulgaria, city of Ruse, 71 Aleksandrovska Street, 1st floor

Correspondence address: Republic of Bulgaria, city of Ruse, 71 Aleksandrovska Street, 1st floor

Telephone: 

E-mail: 

Website: https://saintmarten.com/

I hereby withdraw my consent for processing of the personal data I have provided for the purpose of receiving a newsletter, marketing communication or other marketing materials.

 I am familiar with the conditions for withdrawal of the consent in accordance with the online shop privacy notice.

Signature: