Privacy policy

3.3 Purchase from the online store "DREAM COLOR SHOP"

In order to process an order you have made and to be able to fulfill it, you must provide us with information about the ordered product, including its price, email and phone number (when ordering by phone, by email or through social networks), names delivery address. In the process of order processing, we will keep data about the date and order number, ordered products, amount due, order method, payment method, courier who will deliver the order, and order tracking number. The basis for processing the data is the conclusion and execution of a contract with the data subject.

In order to fulfill our obligation to return the paid amount in case of withdrawal from the contract, we process bank details (IBAN) or mark the presence of customer credit, which you can use at a later stage. The basis for processing this data is the fulfillment of a legal obligation.

We use the data generated in the process of concluding and executing contracts for the sale of our goods to identify and prevent the conclusion of contracts with unscrupulous customers who do not comply with the rules established in our General Terms and Conditions. An example of such processing is the identification of several consecutive cases where the person who must receive the order cannot be found at the address or attempts to order goods that have a damaged commercial appearance. The establishment of such practices will lead to the termination of the customer's registered profile and the refusal to conclude a contract. All decisions to remove registration and/or refuse to conclude a contract are made with human involvement.

3.4 Customer Service

In order to facilitate interaction with customers and potential customers, we process data about such persons when asking questions and inquiries at the announced phone and email. This information includes names, email or phone number, as well as any other information that is provided to us in the process of communication. Please do not provide us with information that is not relevant to our activities!

The basis for these processing activities is the protection of our legitimate interests, which consist of the effective management of relations with customers and potential customers.

3.5 Marketing

To promote our activities and attract new customers, we use various forms of direct marketing. The information we use depends on the type of activity. For example, when we notify you of current goods, promotions and games through messages, we use the provided email address. When we offer you goods through social networks, data about your preferences are also used. We base these activities on legitimate interests in promoting and developing our business, by providing up-to-date information about the goods and promotional conditions we offer.

We may process information about purchases made and for analysis of our activities or for marketing purposes. In this case, the basis for processing is the protection of our legitimate interests, which consist in the development of our business.

In any case, when we use your information for our legitimate interests, we take care and take the necessary measures to ensure that your fundamental rights and freedoms are not affected. You can terminate the processing of your personal data for marketing purposes at any time and we will respond to your request. To do this, you can use the unsubscribe option in the messages you receive, use the notification management functionality in your registered profile or the standard way to exercise rights, as specified below.

We use the data obtained through advertising cookies to create behavioral advertising. You can object to this by deleting and blocking cookies through your browser settings (more information can be found in the Cookie Usage Declaration).

3.6 Social Media Profiles

We maintain profiles on the social networks Facebook and Instagram (services of Facebook Ireland Ltd. 4 Grand Canal Square, D2 Dublin) through which we publish and share content, including commercial messages about the goods and services we offer. When you visit our profiles, the respective social network records your visit and behavior through cookies and other technologies. You can learn more by reading the privacy information that each of them provides to its users.

With regard to the information we receive through the Page Insights service, we are a joint administrator together with Facebook. The service allows us to understand how our pages are used and what is interesting to the people who visit them, but it does not allow us to identify you uniquely. Key elements of the joint administration agreement are available at: https://www.facebook.com/legal/terms/information_about_page_insights_data.

4      From whom do we receive data?

We usually receive data directly from you when you visit, purchase products through our online store or contact us. It is possible that the data may be obtained from other persons, e.g. when the person who places the order and the person to whom the goods are delivered are different.

If you provide us with information about other persons, make sure you have a basis for providing the data (e.g. you have the person's consent) and familiarize the person with this Privacy Policy.

5      How long do we store data?

We keep personal data only for as long as is necessary to achieve the purposes for which it was collected or as provided for in the legislation. The storage periods depend on the type of specific information. According to the requirements of the legislation, data on sales contracts is kept for a maximum period of 10 years. Data about website visitors (saved in log files) for a period of 1 year.

6      To whom do we provide your personal data?

In certain cases, we may provide access to the data to suppliers who support our activities and provide us with the services necessary for the operation of the online store. Such services may be technological development, testing and maintenance of the information system ("Dream Color" Ltd.), hosting and storage of data ("SuperHosting.BG" Ltd.). As our processors, they are obliged to provide a high level of security, and we control the processing activities they perform.

We do not transmit personal data to third countries or international organizations without ensuring a reliable mechanism for protecting your rights in this exchange.

We provide data to the competent state bodies whenever this is provided for by law.

If there is a basis, we may provide data to private entities that process it as independent administrators - e.g. we provide data to courier service providers about the names, phone number, address of the recipient and the amount for payment (if payment is by cash on delivery).

7      Are your data protected?

We take reasonable physical, technical and organizational security measures designed to protect all personal data from loss, misuse, alteration, destruction or damage, in accordance with the requirements of the legislation. We determine these measures based on the risks we have identified, periodically review the provided measures and update them if necessary.

If you want to learn more about the provided measures, please contact us in the ways indicated above.

The responsibility for protecting your data is also yours. Use a password that meets the current security requirements (min. 8 characters, must contain a lowercase and uppercase letter, a digit and a symbol). Keep your access data secret and do not provide it to other persons. Keep in mind that even after leaving our website, you automatically remain in your registered profile, which is why we advise you to always use the "Logout" functionality before leaving the site.

8      What rights do you have?

When processing personal data in connection with our commercial activity, we conscientiously apply the statutory rules for exercising the rights of data subjects.

As a data subject, you have the right to request:

•     to provide you with access to your personal data, while respecting the rights of third parties; •     to delete inaccurate personal data (including the right to have incomplete personal data filled in); •     to delete personal data. Applicable only in the following cases: o  personal data is no longer necessary for the purposes for which it was collected; o  you withdraw your consent and there is no other basis for processing; o  you object to processing based on our legitimate interests and we cannot prove that our interests outweigh your rights; o  personal data has been processed unlawfully; o  deletion is necessary to comply with a legal obligation under Union or Member State law applicable to the controller. •     to limit the processing of personal data to storage only, when: o  the accuracy of personal data is contested; o  the processing is unlawful, but you object to the erasure of the personal data; o  we no longer require the personal data, but you still need it to establish, exercise or defend legal claims; •     to withdraw your consent at any time, without this affecting the processing activities already carried out; •     to exercise your right to data portability - for data that is processed on the basis of a contract or consent, when the processing is carried out by automated means.

You have the right to object to the processing of data based on our legitimate interests at any time and on grounds relating to your particular situation.

If you have any questions or concerns about the processing of your personal data or would like to exercise

If you are a registered user, you can exercise your rights through the "My GDPR" tool, available in your profile.

If you are not a registered user or you want to exercise your rights in relation to data that is not stored in your registered profile, please send a request to exercise your rights to the email address indicated above. In your request to exercise your rights, you should state your names, in order to identify you as the data subject. Specify what your request is. Indicate the address for correspondence with you (physical address, email address), according to the preferred form of communication.

In order to process your request, we need to identify you. This is why you need to send us your request through the email address or phone number with which you are registered in the Online Store or through which we have already communicated (e.g. when communicating through the contact form). If you use an email address different from the one you have already provided to us, please sign the request form or email with a qualified electronic signature.

If necessary, at our discretion, we may request additional identification data, as well as an ID document. We will inform you of the reasons why additional information is required.

If you believe that the processing of personal data is unlawful or violates your rights, you can file a complaint with the Commission for the Protection of Personal Data, with address: Sofia 1592, Prof. Tsvetan Lazarov Blvd. No. 2, with email address: https://www.cpdp.bg/ or to the competent court.

Here's a summary of the points:

• Registered users: Exercise your rights through the "My GDPR" tool in your profile.
• Non-registered users: Send a request to exercise your rights to the email address provided.
• Request content: Your name, the nature of your request, and your preferred contact information.
• Identification: You may need to provide additional identification information if necessary.
• Complaints: If you believe your rights have been violated, you can file a complaint with the Commission for the Protection of Personal Data or the competent court.

I hope this is helpful! Let me know if you have any other questions.