Privacy Policy

Information about the company processing your data:

Company: “Digital Ninja" Ltd.

UIC: 207308629

Registered office and administrative address:

Debar 27, 9000 Varna, ext. 16

Registered office and business address: 

Debar 27, 9000 Varna, ext. 16

Address for correspondence:

same address for correspondence.

Telephone: follows

Email: follows

Website: https://www.digital-ninja.net

Information about the data protection officer:

Jan Lammers, Managing Director of Digital Ninja Ltd.

Telephone: follows

Email: follows

Information about the competent data protection supervisory authority

Data Protection Commission

gr. 1592 Sofia Blvd. "Prof. Tsvetan Lazarov" № 2

phone       +359 2 915 3 518

sitewww.cpdp.bg

 

DIGITAL NINJA LTD., as the data controller, or hereinafter referred to as the "Company", acts in accordance with the Data Protection Act and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals at the Processing of personal data and free movement of data. This information is intended to inform you about all aspects of the Company's processing of your personal data and the rights you have in relation to such processing and has been compiled on the basis of the requirements of the Data Protection Act and in accordance with the practice of the Consumer Protection Commission.

Art. 1. Basis for the collection, processing and storage of your personal data

The person responsible for processing collects and processes your personal data in connection with the use of online services via the website https://www.digital-ninja.net.

 and the possible conclusion of contracts with the company on the basis of art. 1, Regulation (EU) 2016/679 (GDPR), in particular for the following reasons:

• the express consent of you as a customer;

• the Administrator's performance of its obligations under any contract with you;

• compliance with a legal obligation applicable to the Administrator;

• to safeguard the legitimate interests of the controller or a third party.

Art. 2 Purposes and principles of collecting, processing and storing your personal data

(1) We collect and process the personal data that you provide to us in connection with the use of online services via the website.https://www.digital-ninja.net and entering into a contract with the Company, including for the following purposes:

• creating a profile and providing full functionality when using the website;

• Individualization of a contracting party;

• accounting purposes;

• statistical purposes;

• protection of information security;

• Ensuring the performance of the contract for the provision of the service in question;

• Sending you newsletters and emails with special offers if you choose to do so;

• the Company's sending of promotional materials and samples of products from other companies, if you choose to do so;

• Responding to requests made through the feedback form on our website.

(2) When processing your personal data, we observe the following principles:

• legality, fairness and transparency;

• limitation of the purposes of processing;

• Relevance to the purposes of processing and minimization of data collected;

• accuracy and timeliness of data;

• limitation of storage to achieve the goals;

• Integrity and confidentiality of processing and ensuring an adequate level of security for personal data.

(3) When processing and storing personal data, the controller may process and store personal data to protect the following legitimate interests: Fulfillment of its obligations to the National Tax Service, the National Statistical Institute and other state and local authorities.

Art. 3 Which types of personal data our company collects, processes and stores

 (1) The Company carries out the following operations with the personal data provided by you as a customer for the following purposes:

• Registering a customer on the company's website and concluding a service contract or a distance contract - the purpose of this operation is to create a profile for using the site to purchase goods and provide contact details for the delivery of the purchased goods. Registering and creating a profile for using the Website is not a mandatory step in the provision of the Service and, to a significant extent, is also possible without creating a profile via the "Order as a Guest" option;

• Impact assessment conclusion: On the basis of the impact assessment carried out, the Data Protection Officer considers that performing the operation "registering a user on the website and concluding a service contract and a distance contract" is legitimate and provides sufficient safeguards for the protection of the rights and legitimate interests of the provides data subjects in accordance with the requirements of the GDPR;

• Sending newsletters - the purpose of this operation is to manage the sending of newsletters, emails with special offers, promotions, promocodes, news and new features to users who have indicated that they would like to receive them. 

• Exercise of the right of withdrawal or claim - This process is used to manage the exercise of the right of withdrawal or claim by the customer in relation to the goods for which these rights can be exercised. 

• Company's delivery of promotional materials for other companies' products - The purpose of this operation is to manage the process of the Company sending promotional materials and samples of products from other companies to customers who have indicated that they would like to receive them. 

• Submitting requests through the feedback form on the website - the purpose of this process is to send a response to a request. Given the limited scope of the personal data collected, the Data Protection Officer does not consider it necessary to carry out an impact assessment for this operation.

(2) The controller shall not collect or process personal data relating to:

• reveal racial or ethnic origin;

• reveal political, religious or philosophical beliefs or trade union membership;

• genetic and biometric data, health data or data about sex life or sexual orientation.

(3) Personal data are collected by the controller from the individuals to whom they relate.

(4) The person responsible for processing may not carry out any automated decision-making using the data provided by the user.

(5) The company does not collect any data from persons under the age of 16, unless the express consent of their parents or legal representative has been obtained.

Art. 4. Categories of personal data

The controller processes the following categories of personal data and information for the following purposes and reasons:

(1) your personal information (email, name, etc.),

The purpose for which the data is collected is: 

1) contacting the user and providing information to the user;

 2) for the purpose of user registration on the website;

3) to send newsletters, emails with special offers, promotions, promo codes, news and new features;

4) submitting a response to a request via the form on our website.

• Basis for the processing of your personal data - by accepting the General Terms and Conditions and registering on the website https://www.digital-ninja.net or by placing an order without registration or by concluding a written contract, a contractual relationship is established between the Administrator and you, on the basis of which we process your personal data - Art. 1 (b) GDPR. The processing of your data for sending newsletters and e-mails and for answering an inquiry via the form on our website takes place on the basis of your express consent - Art. 6 Para. 1 (a) GDPR. 1(a) GDPR.

(2) Delivery details (names, telephone, address, etc.)

The purpose for which the data is collected is: 

1) Fulfillment of the administrator's obligations under the purchase contract and delivery of the purchased goods, 

 2) Sending promotional materials and product samples from other companies through the Company to customers who have indicated that they would like to receive them.

• Reasons for the processing of your personal data - by accepting the General Terms and Conditions and registering in the e-shop or placing an order without registration, or by concluding a written contract, a contractual relationship is established between the Administrator and you, on the basis of which we process your process personal data - Art. 1 (b) GDPR.

Your data for sending promotional material and product samples will be processed on the basis of your explicit consent - Art. 6, Para. 1. 1 (a) GDPR.

(3) Data from your social media accounts (publicly available information from your Google+ and Facebook accounts)

The purpose for which the data is collected is: 

1) contacting the user and providing information to the user;

2) for the purpose of user registration on the website.

• Reasons for processing your personal data - by accepting the General Terms and Conditions and registering in the e-shop via a social network account, a contractual relationship is established between the administrator and you, on the basis of which we process your personal data - art. 1 (b) GDPR.

Art. 5 Duration of storage of your personal data

 (1) The person responsible for processing will only store your personal data for as long as your profile exists on the website or the order is completed "as a guest". After your profile has been deleted or the order has been completed, the person responsible for processing will take the necessary care to immediately delete and destroy all your data or to make them anonymous (i.e. bring them into a form that does not reveal your identity).

(2) The responsible body stores your personal data transmitted in connection with online orders to protect the legal interests of the responsible body in the event of legal or administrative disputes with users of the online shop for a period of 5 years and the accounting documents for the corresponding legal period.

(3) The controller will notify you if the retention period for the data needs to be extended in order to comply with a legal obligation or with regard to the legitimate interests of the controller or for other reasons.

(4) The person responsible for the processing keeps the personal data which he is obliged to keep under applicable law for the period prescribed in each case, which may exceed the duration of your profile on the website or until the completion of the order.

Art.6 Storage of personal data of the legal representatives of business partners 

 (1) The controller stores the personal data of the legal representatives of its business partners for the duration of the performance of the contract in order to comply with the legitimate interests and legal obligations of the controller, whereby this period may exceed the term of the concluded contract.

 

Art. 7 Transfer of your personal data for processing

 (1) The controller may, at its discretion, transfer some or all of your personal data to processors in order to fulfill the processing purposes to which you have consented, subject to the requirements of Regulation (EU) 2016/679 (GDPR) .

(2) The controller will inform you if he intends to transfer some or all of your personal data to third countries or international organizations.

Art. 8 Revocation of consent to the processing of your personal data

 (1) If you do not want the Company to further process all or part of your personal data for any or all processing purposes, you can withdraw your consent to the processing at any time by filling out the form in your profile or by making a free text request.

(2) The controller may ask you to verify your identity and the identity of the person to whom the data relates.

(3) By withdrawing consent to the processing of personal data required to set up and maintain an account on https://www.digital-ninja.net is required, your account will become inactive. Of course you can browse the website and the offers of the online shop and the products offered and place orders as a guest or register for a new one.

(4) If an order you have placed is being processed, you can revoke your consent to the processing at the earliest after the order has been successfully completed.

(5) You can withdraw your consent to the processing of your personal data for direct marketing purposes at any time.

(6) The revocation of consent does not affect the legality of the processing of personal data carried out by the person responsible for processing up to this point in time.

Art. 9 Right of access

(1) You have the right to request confirmation from the data controller as to whether personal data relating to you is being processed, and if you are a registered user you can view the data that we hold about you at any time in your profile you process.

(2) You have the right to information about the data concerning you and to information about the collection, processing and storage of your personal data.

(3) Upon request, the person responsible for processing will provide you with a copy of the processed personal data concerning you in electronic or other suitable form.

(4) Access to the data is free, but the data controller reserves the right to charge an administrative fee in case of repeated or excessive requests.

Art. 10 Right to correction or supplementation

You can correct or supplement inaccurate or incomplete personal data concerning you directly via your website profile or by submitting a request to the data controller.

Art. 11 Right to erasure ("being forgotten")

(1) You have the right to request the data controller to erase some or all of your personal data, and the data controller is obliged to erase such data without undue delay if one of the following reasons applies:

• the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;

• you withdraw your consent on which the processing is based and there is no other legal basis for the processing;

• You object to the processing of your personal data, including for direct marketing purposes, and there are no overriding legitimate reasons for the processing;

• the personal data have been processed unlawfully;

• the personal data must be erased for compliance with a legal obligation under EU or Member State law to which the controller is subject;

• personal data have been collected in connection with the provision of information society services.

(2) The person responsible for the processing is not obliged to delete the personal data if he stores and processes them:

• exercise the right to freedom of expression and the right to information;

• to fulfill a legal obligation that requires processing under EU or Member State law to which the controller is subject, or to perform a task that is in the public interest or in the exercise of official authority that is responsible for the processing has been delegated to those responsible;

• for reasons of public health;

• for archiving purposes in the public interest, for scientific or historical research or for statistical purposes;

• for the establishment, exercise or defense of legal claims.

(3) Should you exercise your right to be forgotten, the Company will erase all your data except for the following information:

• Information necessary to verify that your right to be forgotten has been fulfilled - email, IP address;

• technical information about the functioning of the website that cannot be linked in any way to your person;

• the e-mail address with which you registered on the website.

(4) In order to exercise your right to be forgotten, you must take the following steps:

• Submit an application for your https://www.digital-ninja.net account or by email;

• provide a unique identification code for performing the action, which will be sent by email to the email address associated with registration on the site;

• Identify yourself as the account holder.

(5) Once we have verified the identity of the person who made the request and the person to whom the data relates in accordance with the steps above, we will delete all data that we process about you in accordance with paragraph 3 . 3.

(6) If an order you have placed is in progress, you can only request "forgetting" after the order has been successfully completed.

(7) By deleting your personal data, your account will become inactive. Of course you can https://www.digital-ninja.net and continue to browse the products offered as a guest and place orders or register for a new one.

(8) The person responsible for processing may not delete the data that he is legally obliged to store, not even to defend against legal claims against him or to prove his rights.

Art. 12 Right to restriction of data processing

You have the right to request that the data controller restrict the processing of your data if:

• contest the accuracy of the personal data, for a period enabling the controller to verify the accuracy of the personal data;

• the processing is unlawful, but you do not want the personal data to be deleted, but only to restrict their use;

• The controller no longer needs the personal data for the purposes of the processing, but you need them for the establishment, exercise or defense of legal claims;

• You have objected to the processing pending verification that the legitimate grounds of the controller outweigh your interests.

(2) If you exercise your right to restriction, the company will suspend the processing of your data, but will not remove the posts you have placed in the online shop.

Art. 13 Right to transferability

(1) If you have consented to the processing of your personal data or the processing is necessary for the fulfillment of the contract with the person responsible or if your data is processed automatically, you can legitimize yourself to the person responsible:

• require the controller to provide you with your personal data in a legible format and transmit them to another controller;

• to require the controller to transmit your personal data directly to a controller designated by you, where technically feasible.

(2) You can download or receive the data stored and processed for you in connection with the use of the services of the data controller at any time directly via your account via the data export option or by e-mail request in machine-readable format.

Art. 14 Right to receive information

You can request the data controller to inform you to which recipients the personal data to which rectification, erasure or restriction of processing has been requested have been disclosed. The controller may refuse to provide this information if it is impossible or requires a disproportionate effort.

Art. 15 Right to object

You can object at any time to the processing of your personal data by the controller, even if it is processed for profiling or direct marketing purposes.

Art 16 Your rights in the event of a data breach

(1) If the controller detects a breach of security of your personal data, which may pose a high risk to your rights and freedoms, he shall immediately notify you of the breach and of the measures that have been taken or are still to be taken .

(2) The person responsible for the processing is not obliged to notify you if:

• has taken appropriate technical and organizational measures to protect the data affected by the security breach;

• has subsequently taken steps to ensure that the breach does not result in a high risk to your rights;

• Reporting would require a disproportionate amount of effort.

Art. 17 Restriction of the rights of data subjects when processing personal data

The controller or processor of personal data may refuse to exercise, in whole or in part, the rights of data subjects under Articles 12 to 22 of Regulation (EU) 2016/679 and its obligation under Article 34 of Regulation (EU) 2016/679 only fail to comply if the requirements of Article 37a of the Personal Data Protection Act are met.

Article 18 Third countries

The person responsible for processing does not transmit your data to third countries.

Art. 19 Time limit in case of violation

In the event of a breach of your rights under Regulation (EU) 2016/679 and the GDPR, you have the right to notify the Commission of the breach within six months of becoming aware of the breach, but no later than two years after the breach to deal with. In such a case, you can lodge a complaint with the Data Protection Commission as follows:

Name Data Protection Commission

Registered office and administrative address 1592 Sofia Blvd. "Prof. Tsvetan Lazarov" № 2

Correspondence address 1592 Sofia Blvd. "Prof. Tsvetan Lazarov № 2

Telephone 02915 3 518

sitewww.cpdp.bg

Art. 20. Exercise of data protection rights by the data subject

You can exercise all your rights regarding the protection of your personal data through the forms attached to this information or through the functionalities in your profile. Of course, these forms are optional and you can submit your requests on any form that contains a corresponding reference and identifies you as the owner of the data.

Art. 21 Logging of data processing operations

The controller ensures that in the event of automated data processing in the automated processing systems it maintains, system logs (logs) are available at least for the following processing operations - collection, modification, query, disclosure, including transmission, combination and deletion - in accordance with the requirements of Article 63 of the Data Protection Act.

Art. 22 Amendment of the data protection regulations

The Company may change the Privacy Policy and Privacy Policy by posting a notice on its website.

The Privacy Policy and Privacy Policy were established on 06/10/2023.

Reference is made to the following forms:

Form for withdrawal of consent to processing - Appendix 1

 

Request "to be forgotten" - to delete personal data concerning me - Appendix 2

 

Request for portability of personal data - Appendix 3

 

Request for correction of data - Appendix No. 4