Privacy Policy

“DONI Zdrave“ Ltd.

Notice on the processing of personal data

Personal data controller

1. Name: “DONI Zdrave“ Ltd.
2. UIC: 208721350
3. Phone: +359 88 622 8326
4. Email address: donyhealth@gmail.com
5. Website: www.donyhealth.com

“DONI Zdrave“ Ltd. (“the Company“ or “the Controller“) carries out its activities in accordance with the Personal Data Protection Act and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (“General Data Protection Regulation“ or “the Regulation“). This Privacy Policy aims to inform every Customer of the Company about the processing of data that identifies or can identify the specific Customer.

For the purposes of this Policy, a “Customer“ is any natural person who is a party to a contract with the Company for the purchase of goods, as well as any natural person who has expressed a wish to enter into pre-contractual relations with the Controller and/or is a user of the online store donyhealth.com.

1. What personal data do we process?

As a personal data controller, the Company processes the following categories of Customers’ personal data:

• Physical identity: names, address, phone number, email address
• Order information: products ordered, delivery address, delivery method
• Technical data: IP address, log file data

Personal data is collected by the Controller from the persons to whom it relates.

2. How do we collect personal data?

We collect personal data:

• During registration in the online store and when using the store without registration
• When corresponding with the Customer in writing or electronically
• Through “cookies“ when using or browsing our website
• Through log files containing data on IP address, browser, operating system and pages visited

3. Do we process special categories of personal data?

The Company does not process special categories of Customers’ personal data.

4. For what purposes do we process personal data?

The Company processes Customers’ personal data for the following purposes:

• Processing, confirming and fulfilling orders
• Delivering the ordered products
• Contacting the Customer about questions or problems with the order
• Issuing invoices and accounting
• Sending a newsletter (only with explicit consent)
• Compliance with regulatory requirements
• Exercising protection in the event of a dispute

5. On what legal basis do we process personal data?

Customers’ personal data is collected, processed and used on the following grounds:

• For the performance of a contract or for entering into pre-contractual relations
• For compliance with a legal obligation that applies to the Company
• For the purposes of the Company’s legitimate interests: resolving disputes, preventing fraud and protecting legal claims
• Under the conditions of voluntarily given consent, where required by law

6. How long do we keep personal data?

• Order data: 5 years from the date of the order
• Accounting documents and tax information: 10 years in accordance with the Accountancy Act
• Account data: until the account is deleted or 5 years from the last login
• Newsletter data: until consent is withdrawn

If judicial or other proceedings are initiated, personal data may be kept until the end of such proceedings, including all appeal periods.

7. Who do we share personal data with?

The Company shares personal data only with:

• Courier company Speedy: only the data needed to carry out the delivery
• Accountants and auditors: where required by law
• Regulatory, tax and law enforcement authorities: in accordance with applicable law

The Company does not provide personal data to third parties for commercial purposes.

8. Is personal data protected?

The Company provides and maintains appropriate technical and organisational measures to protect personal data against unauthorised access, unlawful use, accidental loss, alteration or disclosure.

9. Do we carry out automated decision-making?

The Company does not carry out automated decision-making with data.

10. What are the Customers’ rights?

Every Customer can exercise the following rights by written notice to the Company:

• Right of access: the right to receive information about the data we hold about you
• Right to rectification: the right to request the correction of inaccurate or incomplete data
• Right to erasure (“the right to be forgotten“): the right to request the deletion of data where there are legal grounds
• Right to restriction of processing: the right to restrict processing under certain conditions
• Right to object: the right to object to the processing of data
• Right to data portability: the right to receive your data in a structured format
• Right to lodge a complaint: the right to lodge a complaint with the Commission for Personal Data Protection

Commission for Personal Data Protection
Address: 2 Prof. Tsvetan Lazarov St., Sofia 1592
Tel.: (02) 91 53 519
Email: kzld@cpdp.bg
Website: www.cpdp.bg

11. Changes to the Policy

In the event of a significant change in the way the Company processes personal data, Customers will be notified in good time through an updated version of this Policy published on www.donyhealth.com.