DATA PRIVACY AND COOKIE POLICY

Introduction

Your privacy is important to us. This Data Privacy and Cookie Policy (the “Policy”) is intended to explain how we collect, store, use and disclose your personal information when you use our website, our products and services, or otherwise interact with us for various purposes. This Policy describes the types of information we may collect from you or that you may provide to us, as well as our practices for collecting, using, maintaining, protecting and disclosing such information.

We at Magnum Bulgaria Gamma EOOD respect your privacy and are committed to protecting it by complying with this Policy. We process your personal information in accordance with the fundamental principles of transparency and fairness, lawfulness, data minimisation and confidentiality.

Please read this Policy carefully to understand our policies and practices regarding your personal information and how we will treat it. If you do not agree with these policies and practices, you may choose not to use our website, products and services or otherwise interact with us.

Who We Are

The data controller (“we”, “us” or “our”) is Magnum Bulgaria Gamma EOOD, a company registered with the Bulgarian Commercial Register at the Registry Agency of the Republic of Bulgaria, with its registered office and management address at 15 Tsaritsa Yoanna Blvd., Lyulin District, Sofia, Bulgaria (“Magnum Bulgaria Gamma EOOD”).

What Data We Collect and How

Under the EU General Data Protection Regulation (GDPR), personal data is defined as “any information relating to an identified or identifiable natural person (‘data subject’)”; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Magnum Bulgaria Gamma EOOD collects a limited amount of your personal data:

  • identification and contact information, such as your name, telephone/mobile number, email address, job title and organisation, and IP address, as necessary for the specific purpose;
  • a recording of your voice when you call our technical support team;
  • your voice and/or image if you participate in our events and such events are recorded.

We collect your personal data either directly from you (e.g. when you purchase a service or online application, make an enquiry, register for an event or subscribe to our newsletter) or passively (e.g. when you use tracking technologies such as browser cookies). We may also collect information about you indirectly from third parties (e.g. our business partners or social media platforms).

“Usage Information” or “Usage Data” means information about an individual’s online activity that does not, by itself, identify the individual, such as browser type, operating system, the most viewed and visited pages and links on our website, the most common entry and exit points, the number of completed forms, time spent on pages, most popular downloads, most popular keywords used outside the website to direct customers to our website, information collected through cookies, and other information about events on the device, such as system activity, crashes and hardware settings. We automatically collect Usage Data when you interact with our website. Each time you use the website or services, we use location information from your mobile device or browser to tailor the services and website experience to your location.

As a general rule, we do not consider Usage Data to constitute personal data, as Usage Data by itself does not normally identify a natural person. Personal Data and Usage Data may, however, be linked together. Different types of Usage Information may also be linked together and, once combined, may identify a natural person, in which case the principles governing the processing of personal data will apply.

How Your Information Is Used and on What Legal Basis

Below you will find information about the purposes for which we use your personal information, the legal bases for such processing, and the applicable retention periods.

Operation of Our Website

As you navigate through and interact with our website, we may use automatic data collection technologies to collect certain information about your equipment, browsing actions and patterns, including: details of your visits to our website, including traffic data, location data, log files and other communication data and resources that you access and use on the website; information about your computer and internet connection, including your IP address, operating system and browser type. We may also use these technologies to collect information about your online activities over time and across third-party websites or other online services (behavioural tracking). For further information, please refer to the Cookie Policy section of this Policy.

The processing of your personal information for the operation of our website is based on Article 6(1)(f) of the GDPR, under which our primary legitimate interest is to operate, improve and personalise the website and services, including gaining a better understanding of how users access and use the website and services; providing customer service and responding to user preferences, including language and location customisation; providing personalised assistance and instructions; personalising our marketing; and detecting, preventing and mitigating fraudulent or unlawful activities.

Personal Information Processed for the Purpose of Contacting You

You may contact us via the contact form on our website, by email or by telephone. If you do so, the information you enter in the form, your email address and/or your telephone number will be disclosed to and processed by us.

The legal basis for processing your contact details is Article 6(1)(f) of the GDPR, as we have a legitimate interest in processing your enquiry and continuing our communication with you. If you have contacted us for the purpose of establishing a business relationship with Magnum Bulgaria Gamma EOOD, the legal basis for processing your contact details is Article 6(1)(b) of the GDPR.

We will retain your contact details until we have processed your enquiry and any subsequent communication has ended. This also applies if you have contacted us to establish and enter into a business relationship or to exercise your rights as a data subject. In such cases, personal information may subsequently be processed on a new legal basis and will be deleted as soon as the purpose of the processing has been fulfilled and the applicable statutory retention periods have expired.

Personal Information Processed for Marketing Purposes

We may use your information to contact you by post, email or otherwise with information or content from Magnum Bulgaria Gamma EOOD regarding our business, services and events, special offers and other information that we believe may be of value to you, or to send you marketing communications or newsletters relating to our business. It is in our legitimate business interest, pursuant to Article 6(1)(f) of the GDPR, to provide you with communications that we have determined to be relevant to your interests.

Our website offers you the opportunity to subscribe to newsletters free of charge and to download or access certain content relating to current topics within our areas of business. To subscribe to a newsletter, you must register using your name and email address. Access to certain content on the website may require you to complete a registration form and provide personal information such as your name, email address, telephone number, job title and organisation. Whenever you register, your consent will be obtained and recorded through an opt-in mechanism, and your data will be stored in our customer database.

When you subscribe to newsletters or access content on our website, we may analyse your customer profile and preferences and conduct multi-channel marketing campaigns using automated tools, contact you by email, or send you brochures or other advertising or promotional materials.

Your personal information will be retained for the duration of your newsletter subscription. If you withdraw your consent, your data will no longer be used for this processing purpose.

We collect and process your personal information when you register for events organised by us. We use this information for the purposes of your participation in the event, providing follow-up materials relating to the event, compiling visitor statistics and conducting subsequent advertising activities. In this situation, processing is based on Article 6(1)(f) of the GDPR, with customer care and customer acquisition constituting our primary legitimate interests.

Please note that some of our events may be recorded in image and sound and may subsequently be distributed to participants, published or made available on our website following registration, or shared through our social media channels. In addition to photographs and video recordings, digital cameras automatically store metadata such as the location and time of the recording. The legal basis for creating and storing photographs and video recordings is Article 6(1)(f) of the GDPR, where our legitimate interest is to document and promote the event. If you do not agree to the above processing of your personal information, you may choose not to register for the event.

Data collected at an event may also be processed for advertising purposes. This processing is based on our legitimate interest pursuant to Article 6(1)(f) of the GDPR in establishing potential business relationships with event participants. If, when registering for the event, you have consented to the use of your telephone number and/or email address for advertising contacts, Article 6(1)(a) of the GDPR will apply.

Unless a statutory retention period applies, we will delete your information processed for marketing purposes when it is no longer required for its intended purpose. If the information is required for other legally permitted purposes, it will not be deleted, but its processing for marketing purposes will be restricted.

Personal Data Processed Within Business Relationships

In the course of conducting business relationships, we use personal data for the purposes of:

  • pursuing, establishing and conducting business relationships with customers, partners or interested parties;
  • performing our contractual obligations towards customers, partners or interested parties;
  • processing and invoicing business transactions;
  • advertising and marketing activities;
  • product support, maintenance, diagnostics and troubleshooting;
  • transferring data to third parties or service providers as part of the management of our business processes.

Article 6(1)(b) of the GDPR serves as our company’s primary legal basis for such processing.

Within the context of business relationships, we may also process your data pursuant to Article 6(1)(f) of the GDPR, where our legitimate interest is to promote our sales and conduct our business in a manner that satisfies our customers and interested parties, or on the basis of your explicit consent pursuant to Article 6(1)(a) of the GDPR.

We will delete your personal information processed within the context of business relationships when it is no longer required for its intended purpose or when your consent has been withdrawn, unless retention of the information is required by statutory retention requirements.

Disclosure of Information and Joint Controllers

Our aim is to limit the sharing of personal information that we collect or that you provide to us, as described in this Policy. However, we may sometimes need to use partners or processors in order to provide you with the requested services and a better experience for the purposes described above, or we may have another lawful reason to disclose your personal information.

In connection with the use of marketing tools (e.g. Meta Pixel) for remarketing and audience creation purposes, we and Meta Platforms Ireland Limited (“Meta”) act as joint controllers of personal data within the meaning of Article 26 of the GDPR. This joint controllership covers the collection of data through the website and its transmission to Meta. The joint responsibility is governed by a specific agreement with Meta (Controller Addendum).

We may disclose personal information:

  • to contractors, service providers and other third parties that we use to support our business and achieve the purposes for which the information is disclosed, and which are bound by contractual obligations to keep personal information confidential and use it only for the purposes for which we disclose it to them;
  • where necessary to fulfil the purpose for which you provide the information;
  • with your consent, including to unaffiliated marketing partners;
  • where necessary to enforce our rights, protect our property or protect the rights, property or safety of others, or where necessary to support external audit, compliance and corporate governance functions;
  • in connection with a merger, sale, acquisition or other change in the ownership or control of or involving Magnum Bulgaria Gamma EOOD. Where any such event occurs, we will make reasonable efforts to notify you before your information is transferred or becomes subject to a different privacy policy;
  • where required by law, for example in response to a subpoena, regulation, binding order of a data protection authority, law enforcement agency or court, or in the course of judicial or regulatory proceedings.

Please note that we may use and disclose personal information about you that cannot personally identify you, i.e. personal information in aggregated form that no longer identifies you, without restriction.

Do I Have to Provide Personal Data?

As a general principle, providing any consent and any personal data referred to above is entirely voluntary; there are generally no adverse consequences for you if you choose not to provide consent or personal data. However, there are circumstances in which we cannot take action without certain personal data, for example because such personal data is necessary to process your enquiries or orders or to provide you with access to an offer, newsletter or event. In such cases, without the relevant personal information, Magnum Bulgaria Gamma EOOD will unfortunately be unable to provide you with what you have requested.

Where We Store Your Personal Data

The data we collect from you will be transferred to and stored within the European Union. Magnum Bulgaria Gamma EOOD will take all reasonably necessary steps to ensure that your data is treated securely and in accordance with this Policy. All information you provide to Magnum Bulgaria Gamma EOOD is stored on secure servers.

Unfortunately, the transmission of information over the internet is not completely secure. Although we will make every effort to protect your personal data, we cannot guarantee the security of data transmitted through electronic communication channels; any such transmission is at your own risk. Once we receive your information, we will use strict procedures and security features designed to prevent unauthorised access.

Transfers of Personal Data to Third Countries

We may occasionally transfer personal data to recipients located outside the European Economic Area (EEA), in so-called third countries, such as the United States, when using tracking tools provided by Google and Meta.

Where such a transfer becomes necessary, we will ensure either that the recipient provides an adequate level of data protection (e.g. pursuant to an adequacy decision of the European Commission concerning the relevant country, including the EU-U.S. Data Privacy Framework), or that an agreement based on the so-called Standard Contractual Clauses (SCCs) has been entered into with the recipient, or that you have consented to the transfer.

Automated Decision-Making and Profiling

Your personal data is not subject to automated decision-making, including profiling.

What Are Your Data Protection Rights?

Under applicable Bulgarian and European legislation, you have the following rights in relation to your personal data processed by us:

  • You may request access to the personal information we hold about you. If you make such a request, we will provide you with information about the purposes of processing, the categories of data processed, the categories of recipients, the applicable data retention periods, and your rights to rectification, erasure or restriction of the data concerned, where applicable. Where possible, we will provide remote access to a secure system that would give you direct access to your personal data.
  • You have the right to have the record of your personal data maintained by Magnum Bulgaria Gamma EOOD rectified if it is inaccurate.
  • You may request Magnum Bulgaria Gamma EOOD to complete or update your personal data.
  • You may withdraw your consent to the processing of personal data at any time, without affecting the lawfulness of processing carried out prior to the withdrawal of consent.
  • You may also request that Magnum Bulgaria Gamma EOOD cease using your data for direct marketing purposes.
  • You may request restriction of data processing: (i) for a period that allows us to verify the accuracy of your personal data if you contest its accuracy; (ii) where the processing is unlawful and you wish to restrict the use of your personal information rather than have it erased; (iii) where you wish Magnum Bulgaria Gamma EOOD to retain your personal information because you require it for the establishment, exercise or defence of legal claims; or (iv) where you have objected to the processing but we need to verify whether we have legitimate grounds for such processing that may override your rights.
  • You may request the erasure of your personal information if: (i) your personal information is no longer necessary for the purposes of the data processing; (ii) you have withdrawn your consent to data processing where the processing is based exclusively on such consent; (iii) you have objected to the processing of the data; or (iv) the personal information must be erased in order to comply with a legal obligation applicable to Magnum Bulgaria Gamma EOOD. We will take reasonable steps to inform entities that may be involved in the processing of the data of such erasure.
  • You have the right to lodge a complaint with the competent data protection authority if you have concerns regarding the manner in which Magnum Bulgaria Gamma EOOD processes your personal data.
  • Where technically feasible, Magnum Bulgaria Gamma EOOD will provide your personal data to you or transmit it directly to another controller at your request. You have the right to receive your personal information in a structured and commonly used format.

Upon your request for access to your personal data, Magnum Bulgaria Gamma EOOD will take all necessary steps to provide you, free of charge, with the required information concerning the processing. Where a request is manifestly unfounded or excessive, particularly because of its repetitive nature, Magnum Bulgaria Gamma EOOD may charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the requested action, or may reasonably refuse to act on the request.

Questions and Complaints

If you have any questions regarding this Policy, the processing of your personal information, or if you wish to exercise your privacy rights, please contact us by email at: k.sabeva@westmall.bg.

If you believe that your data protection rights have been infringed, you may lodge a complaint with the competent data protection authority of the Republic of Bulgaria – the Commission for Personal Data Protection (CPDP; in Bulgarian: „Комисия за защита на личните данни“, КЗЛД). The CPDP is responsible for the protection of personal data in both the public and private sectors.

Contact details of the CPDP:

Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria

Email: kzld@cpdp.bg

Website: www.cpdp.bg

Cookie Policy

For information regarding the use of cookies and tracking technologies on our website, please refer to our separate Cookie Policy, which forms an integral part of this Privacy Policy.

Changes to This Data Privacy Policy

This Policy may be amended from time to time to reflect changes in the way we process your personal information. Any such changes will, however, remain fully compliant with applicable legislation.

We recommend that you review this page periodically for the latest information regarding our privacy practices. We will notify you of any material changes to this Policy as required by law.