BG
BG
BG
BG

Privacy Policy

Personal data protection policy

This policy has been prepared and fully complies with Regulation (EU) 2016/679 on the protection of personal data ("General Data Protection Regulation"), which is directly applicable in the territory of all EU member states, starting from May 25, 2018 . "FEN FOOD" EOOD, in its capacity as ADMINISTRATOR regarding personal data, acquires the right to process and store personal data of users, employees and other natural persons.

  1. Concepts and definitions

Concepts and definitions

"Data subject" is a natural person who can be identified, directly or indirectly, by an identifier / name, identification number, location data, online identifier or by one or more characteristics specific to the physical, physiological, genetic, mental, mental, economic, cultural or social identity.

The company "FEN FOOD" EOOD keeps the relevant registers related to the personal data of the subjects whose data it processes and stores in the relevant terms. It has also developed relevant policies and internal rules, and has taken the necessary technical and organizational measures to ensure the protection of personal data of its users, employees, contractors and other data subjects - natural persons.

"FEN FOOD" EOOD complies with the requirements of the General Regulation on the protection of personal data (Regulation (EU) 2016/679) and will process personal data of the subjects only on the grounds and terms specified in the General Regulation on the protection of personal data.

2. Grounds for processing personal data

According to the General Regulation on the protection of personal data, the grounds for processing are:

- consent of the data subject – separate consent is given for each specific purpose;

-execution of contract;

- legal obligation;

- protection of vital interests of the subject or another person,

-task in public interest;

-legitimate interests pursued by the controller or a third party.

Personal data is processed only in connection with a specific purpose and when the purpose is achieved or it ceases, the administrator is no longer entitled to store personal data. Data must be stored for as short a time as possible. This period must be consistent with the reasons why the controller is processing the data, as well as any legal obligations to store the data for a certain period of time.

3. When do we collect your personal data?

– When you contact us by phone through our call center, by email, through social media (Instagram, Facebook)

– When you subscribe to our newsletter (for direct marketing purposes

4. What personal data do we collect?

-When placing orders over the phone, we require that you correctly provide your names, phone number and shipping address in order for us to fulfill the order

-When contacting us via social media we may require you to provide your correct names, telephone number and delivery address

-When you subscribe to our newsletter, we require your email address

– When you send us an inquiry using the contact us form on the site, we require a name, phone number and email

5. For what purposes do we use your personal data? We collect and use personal data primarily for direct sales, direct marketing and customer service purposes. We also collect data about persons seeking employment or working in our Company.

We may use your personal data for the following purposes:

  • Sending marketing messages that you have consented to. Include information about our products and services
  • Fulfillment of orders for the delivery of a product of your choice
  • Respond to inquiries, comments and any questions
  • Fulfillment of contractual obligations in connection with the delivery of products and services
  • Notice of Termination of Our Services
  • Processing of applications for personnel selection

6. How long do we store your personal data?

We store personal data for as long as is necessary in relation to the purpose for which it is processed. At the same time, we ensure accurate and timely response to your requests in connection with the exercise of your rights as subjects of personal data, specified below, to comply with the legal requirements for the period of data storage according to the applicable legislation.

7. Data Privacy

"FEN FOOD" EOOD does not share, transmit and distribute your personal data to third parties without your express consent, unless this is required by law. As a data controller, we will do our best to ensure that your personal data will be protected and treated as strictly confidential.

8. Subject Rights

"FEN FOOD" EOOD respects the rights of the subjects of personal data specified in the General Regulation on the Protection of Personal Data, namely: right to information - during the collection of data, natural persons (data subjects) must be clearly informed about: who is the controller of personal data; for what purposes it will use their personal data; the categories of relevant personal data; the legal basis for processing their data; how long it will keep the data; who else can get them; whether their personal data will be transferred to a non-EU recipient; data subjects must be informed that they have the right to a copy of the data (right of access to personal data); right to correct personal data; right to erasure (the right to be forgotten); right of objection to the administrator, right of subjects to file a complaint with the data protection supervisory authority (Personal Data Protection Commission) when they consider that their rights have been violated; their right to withdraw their consent at any time; right to object to direct marketing.

9. Procedure for exercising the rights of data subjects:

When requesting access to personal data, you also have the right to receive a copy of your personal data. However, this does not mean that you must receive a copy of the documents that contain the personal data, but that the administrator must provide you with the data in an "intelligible form" - e.g. if codes are used, a key to these codes must be provided so that the subject can understand Access requests must be made in writing/electronically in the form of a free form application/request (you can also use administrator forms ) and be addressed to the Data Protection Authority at the specified contacts in this application/request - office address, e-mail or registered with a return receipt to the postal address. The request/request must include all details about the subject, the type of personal data and any other information that will help the controller to locate and identify your personal data. The administrator may request additional information aimed at specifying the personal data or processing activities to which the request refers. Access can be granted to archived data, but not to deleted data. The administrator provides a response to the request within one month of receipt. Please note that the administrator has the right to refuse access to your personal data in certain cases (e.g. if it is not clear for which personal data access is requested or it is not clear who submitted the access request, as well as when it concerns for the protection of national and public interests), and in all cases he should give reasons for the refusal. In case of refusal, you have the right to appeal to the data protection supervisory authority the information (for example, if the data is encrypted).

10. Right to information and access to personal data:

Right to correct your personal data that is inaccurate/out-of-date (for example, correction can be requested when the name, address or other information about the data subject is wrong or when there has been a change in information already provided). For this purpose, you must submit a separate request or request in free form (you can also use the administrator's forms; please refer to the Data Protection Officer indicated in this declaration), addressed to the Data Protection Officer of the administrator. In the request/request, you should indicate the data you want corrected, as well as your current data. If the administrator refuses to correct the data, he must explain the reasons for this, informing you of the right to file a complaint with the data protection supervisory authority (Personal Data Protection Commission).

Right to restrict the processing of personal data – this does not mean deletion of the data, but that the data controller can keep the data, but the purposes for which the data can be processed are strictly limited. The limitation is allowed in the following cases:

A. when you consider that your personal data is not accurate, in which case the limitation is for a period in which the administrator can verify the accuracy of your personal data;

B. when the processing of your personal data is illegal, but you do not want them to be deleted, but you only want to limit their use;

C. when the administrator no longer needs your personal data for the purposes of processing, but you, as the data subject, require them for the establishment, exercise or defense of legal claims;

D. when you have objected to the processing pending verification that the controller's legitimate grounds prevail over your interests.

For this purpose, in the presence of any of the conditions specified in this paragraph, you should submit a request or request in a free form (you can also use the forms of the administrator; please refer to the GDPR indicated in this declaration), addressed to the GDPR of the administrator. If the administrator refuses to restrict your personal data, he should do so only explicitly and in writing, justifying the legitimate reason for this refusal.

Right to request that personal data be deleted without undue delay ie. the controller to delete your personal data from all systems and records where it is stored, including notifying any third parties/processors of personal data to whom it has provided the data.

A request for deletion may be submitted if any of the following grounds exist:

A. the personal data are no longer necessary for the purposes for which they were collected;

B. when you have withdrawn your consent;

C. when you have objected to the processing, when the processing is unlawful;

D. when the personal data must be deleted in order to comply with a legal obligation under the law of the European Union or the law of a Member State that applies to the controller;

E. when personal data were collected in connection with the provision of information society services.

For this purpose, you should submit a request or request in a free form (you can also use the administrator's forms; please contact the Data Protection Authority.

11. The administrator may refuse to delete personal data for any of the following reasons:

A exercising the right to freedom of expression and the right to information;

B for compliance with a legal obligation by the controller or for the performance of a task in the public interest, or in the exercise of official powers that have been granted to the controller;

C for reasons of public interest in the field of public health;

D for the purposes of archiving in the public interest, for scientific or historical research or for statistical purposes, to the extent that deletion is likely to make impossible or seriously hinder the achievement of the purposes of this processing; or for the establishment, exercise or defense of legal claims.

If it refuses to delete the data, the administrator must explain the reasons for this, informing you of the right to file a complaint with the data protection supervisory authority (Personal Data Protection Commission).

Right to object to the processing of personal data at any time. The objection should be addressed to the administrator at the above contacts. In the objection, you must indicate the grounds related to your specific situation, on which you object to the processing. Your right to object to direct marketing is absolute (ie you don't need to state any grounds for objecting). After receiving the objection, the controller should stop processing your data, unless it provides compelling legal grounds for the processing that take precedence over your interests or to exercise legal claims. If the administrator rejects the objection, he must explain the reasons for this, informing you of the right to file a complaint with the data protection supervisory authority (Personal Data Protection Commission).

Right to appeal against the processing of personal data or non-compliance with the rights of the subjects in connection with the protection of personal data before the competent supervisory authority - Commission for the Protection of Personal Data.

12. Additional data:

When there is a risk of a breach of personal data security, the ADMINISTRATOR is obliged to notify the nature of the breach and what measures have been taken to remedy it, as well as whether the supervisory authority has been notified of the breach.

With each processing of personal data, "FEN FOOD" EOOD provides the subjects with clear and detailed messages (in the form of "confidentiality statements"), which contain information about what, for what purpose, for what period and in what way the company collects and processes their personal data; all details of the controller and the Data Protection Officer appointed by him; contacts of personal data processors; other recipients to whom personal data is disclosed; the rights of subjects and the practical means of exercising them. It is stated that personal data will be collected for specific and legitimate purposes and will not be processed in a manner incompatible with those purposes.

On the figma.com site, links to Facebook, Instagram, Youtube.

If you use Facebook, please note that the controller of personal data for users outside the United States or Canada is Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, in Ireland.

If you use Instagram, you can find more information about data protection at https://help.instagram.com/155833707900388 and https://www.instagram.com/about/legal/privacy. Instagram is owned by Instagram LLC, 1 Hacker Way 14, Menlo Park, California, USA.

За защита на правата на субектите на лични данни и гарантиране сигурността на личните данни „ФЕН ФУУД” ЕООД  е въвело подходящи технически и организационни мерки.

In the event of a violation of the protection of your personal data, the administrator "FEN FOOD" EOOD will make a specific risk assessment and, in the cases determined by the regulation, will notify both the Commission for the Protection of Personal Data and the data subject of the violation.

Всякаква информация във връзка с техните права или по други въпроси, свързани със защитата на личните данни, субектите могат да получат, като се обърнат към Длъжностното лице по защита на данните на „ФЕН ФУУД” ЕООД  контакти:  fensifastfood@gmail.com