I. INTRODUCTION

This Privacy Policy, hereinafter referred to as the “Privacy Policy,” provides information on how “Fast Food Product” EOOD, hereinafter referred to as the “Provider,” “Administrator,” “we,” and/or “us,” the owner/operator of the website: https://shop.magicalnuts.com, hereinafter referred to as the “Website,” processes (including, but not limited to, collects and stores) personal data of data subjects, such as users of the Website and the Provider’s services, hereinafter referred to as “User/s,” “You,” and/or “Your,” as well as the rights of the latter in this regard.

The term “personal data” used in the Privacy Policy has the meaning given to it in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, hereinafter referred to as the “General Data Protection Regulation” and/or “GDPR,” namely: “any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.”

Below you can find brief information regarding:

The Provider,
The competent supervisory authority,
The legal basis on which we process personal data,
The purposes for which we use personal data,
Principles of personal data processing,
What personal data we collect,
The retention period of personal data,
Access to and transfer of personal data, and
The rights and guarantees that the GDPR provides to data subjects.

II. INFORMATION ABOUT THE PROVIDER

1. Name: “Fast Food Product” EOOD, UIC 202462993
2. Registered office and address: BULGARIA, Sofia, Triaditsa district, Ivaylo Petrov St., 5, 6th floor
3. Phone: +359 876 700 000, email: [email protected]
4. Registration in public registers: Commercial Register at the Registry Agency to the Ministry of Justice of the Republic of Bulgaria.

III. INFORMATION ABOUT THE COMPETENT SUPERVISORY AUTHORITY

1. Name: Commission for Personal Data Protection of the Republic of Bulgaria
2. Address: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.
3. Phone: 02 915 3 518
4. Email: [email protected]
5. Website: https://www.cpdp.bg/

IV. BASIS FOR COLLECTING, PROCESSING, AND STORING PERSONAL DATA

We process (including, but not limited to: collect and store) Your personal data solely in connection with our activities and in accordance with the requirements of applicable legislation, including the Personal Data Protection Act of the Republic of Bulgaria and the General Data Protection Regulation.

We process your personal data based on at least one of the following grounds:

User’s consent for the processing of personal data;
Processing is necessary for the performance of the Provider’s contractual obligations to the User;
Processing is necessary to take steps at the User’s request prior to entering into a contract;
Processing is necessary for compliance with a legal obligation to which the Provider is subject;
Processing is necessary for the purposes of the legitimate interests pursued by the Provider in carrying out its activities.
Processing is necessary for the fulfillment of an order by the User to the Provider.

V. PURPOSES FOR COLLECTING, PROCESSING, AND STORING PERSONAL DATA
We collect, process, and store

Users’ personal data in connection with the provision of our services and communication regarding the use of the Website, as well as for the following purposes:

Communication and identification in the performance of a service contract and a sales contract (including the execution of the relevant contract);
Communication, identification, processing, and execution of inquiries, orders, requests, reservations, purchases of goods or services (including preparation for contract conclusion, order acceptance, shipment of goods, solving problems related to order cancellations, reservations, returns of purchased goods, refunds, and more);
Fulfillment of tax and other legal obligations;
Accounting purposes related to the use of our services;
Protection of our legitimate interests in relation to the fulfillment of our obligations to state and municipal authorities (e.g., National Revenue Agency, Ministry of Interior);
Protection of our legitimate interests in relation to storing information to defend against legal or tax claims and to improve the performance of the Website;
Protection of the information security of the Website;
Statistical information on the use of the Website;
Providing advertising content according to the User’s interests;
Leaving comments on the content of the Website;
If a data subject refuses to provide us with some or all of the personal data necessary for the respective purpose mentioned above, we may not be able to provide the relevant service (e.g., to execute a contract concluded with the respective User) or to fulfill the respective legal requirements (e.g., to enable the data subject to exercise their rights under the GDPR).

VI. PRINCIPLES OF COLLECTING, PROCESSING, AND STORING PERSONAL DATA

We adhere to the following principles when collecting, processing, and storing your personal data:

Lawfulness, fairness, and transparency;
Purpose limitation;
Data minimization;
Accuracy and timeliness of data;
Integrity and confidentiality of data processing and ensuring an appropriate level of personal data security.

VII. PERSONAL DATA

We collect the following categories of personal data of Users for the following purposes and on the following grounds:

• Your individual data (first and last name, phone number, and email address), as well as other data you provide voluntarily, for the purposes of processing your inquiries, providing service offers, and providing services from our side, upon your request, including communication with you in this regard, based on steps taken at your request for potential contract conclusion, contract performance to which you are a party, or consent to processing provided by you;
• Your individual data (first and last name, phone number, and email address) and payment-related information for issuing and sending accounting/tax documents (invoices) in connection with the services used by you, including communication with you in this regard, based on steps taken at your request for potential contract conclusion, contract performance to which you are a party, or compliance with our legal obligation;
• Your individual data (first and last name and email address) and information related to leaving comments on the content of the Website, upon your request;
  Your IP address, browser settings, and preferred language, visited pages, and actions taken for the purpose of sending push notifications, upon your request to receive such;
• Your IP address, visited pages, for the purpose of information security protection;
  Other data that may be necessary in certain cases or related to the provision of services to Users from our side, including necessary for fulfilling obligations under a contract (e.g., date of birth, signature, personal identification number) or other data that Users voluntarily choose to share with us, based on contract performance to which you are a party, consent to processing provided by you, or compliance with our legal obligation.

We use cookies on the Website, which are small files downloaded to your computer to improve your experience as a website user. You can find more information about this on our dedicated cookie policy page here.
We do not process or collect special categories of personal data from Users (e.g., data revealing racial or ethnic origin, political opinions, genetic or biometric data, and data concerning sexual life and sexual orientation).
We do not make decisions based solely on automated data processing, including profiling.
Usually, we receive personal data directly from the data subject. However, it is not excluded that we may receive personal data from other persons such as other employees in the company where the respective data subject works and from publicly accessible sources such as the Commercial Register and Register of Non-Profit Legal Entities at the Registry Agency to the Ministry of Justice of the Republic of Bulgaria.

VIII. PERSONAL DATA RETENTION PERIOD

We retain Users’ personal data for no longer than necessary to achieve the respective purpose of processing or the legally established period, where applicable. For example:

• Personal data provided by you when filling out the contact form will be retained until the request is fulfilled or the inquiry is addressed, as well as up to one year afterward for statistical and marketing analysis;
• Personal data of our clients processed in connection with contracts concluded between us and the respective User will be retained for a period no longer than ten years, starting from January 1 of the year following the year in which the contract was accounted for tax purposes;
• Personal data of our clients processed in connection with the issuance of tax documents (invoices) will be retained for a period no longer than ten years, starting from January 1 of the year following the year in which the document was accounted for tax purposes;
• Personal data of our partners/suppliers processed in connection with contracts concluded between us and the respective partner/supplier will be retained for a period no longer than ten years, starting from January 1 of the year following the year in which the contract was accounted for tax purposes;
• Personal data of participants in recruitment and selection procedures will be retained for a period no longer than six months from the final completion of the recruitment/selection procedure in which the respective data subject participated, respectively after the expiration of the appeal period of the given procedure, unless the data subject has consented to the retention of their data for a longer period, in which case the data subject has the right at any time and without giving reasons to withdraw their consent.

The retention period also depends, among other things, on the duration of the relationships arising between us and the respective User, as well as the purposes for which the personal data is processed. When there are indications of potential legal claims or liability, these periods will be

accordingly extended. When the processing is based on the User’s consent (e.g., in the cases of personal data provided by third parties for direct marketing), we retain these personal data as long as we have valid consent for their processing.
After the expiration of the above periods, we take the necessary care to delete and/or destroy the respective personal data without undue delay.

IX. ACCESS TO PERSONAL DATA AND TRANSFER OF PERSONAL DATA TO THIRD PARTIES

In general, the personal data of Users that we process are accessible to our employees, representatives, and partners who need them to fulfill legal obligations and/or perform contractual obligations (e.g., providing a specific service under a contract with a User). In this regard, at our discretion and in compliance with the requirements of the GDPR, we may transfer all or part of your personal data to third parties such as accountants, professional advisors, including lawyers (for the purposes of financial-accounting and administrative service of our activities), cloud platforms for data processing/storage (for the purposes of organizational service of our activities, e.g., storing and processing contracts with Users on cloud platforms for greater security), companies providing postal services (for the purposes of organizational service of our activities, e.g., sending paper contracts to Users), IT service providers, system administration, marketing services (for the purposes of providing more reliable and quality work of the Website and more secure data processing), service providers for storing foreign information (i.e., hosting companies) (for the purposes of fulfilling contracts with Users).
Based on applicable legislation or upon request from public authorities, all or part of your personal data may be accessible to public authorities.
We do not intend to transfer your personal data to countries outside the European Economic Area or to international organizations.

X. RIGHTS OF DATA SUBJECTS

At any time while we process your personal data, and subject to the limitations laid down in applicable legislation, you, as the data subject, have the following rights:

Right of access – you have the right to request information about whether we process your personal data, as well as to receive access to and a copy of such personal data; if you request more than one copy of such personal data, you may owe a fee for each additional copy;
Right to rectification – you have the right to request that your personal data be corrected if you believe they are inaccurate or incomplete. We will make such corrections without undue delay;
Right to erasure/to be forgotten – under certain circumstances (e.g., the respective personal data is no longer necessary for the purposes for which it was collected; you have withdrawn your consent for processing certain personal data, for which there is no other legal basis for processing), you can request that your personal data processed by us be deleted from our registers/our database without undue delay. In certain cases, we may refuse to delete such personal data (e.g., processing of personal data is necessary to comply with a legal obligation or for the establishment, exercise, or defense of legal claims);
Right to restrict processing – when certain conditions are met (e.g., processing certain personal data is unlawful, but you do not want these data to be deleted), you have the right to request that the way your personal data is processed be restricted;
Right to data portability – when your personal data has been provided by you and is processed automatically, you have the right to request that these personal data be transferred to you in a structured, commonly used, and machine-readable format, as well as to be transferred to another data controller, if technically feasible;
Right to object – you have the right to object at any time to the processing of your personal data for certain purposes, in which case we will stop using the personal data for the specific purpose, unless we have overriding legitimate grounds for this (e.g., you have the right at any time to object to the processing of your personal data for direct marketing purposes, in which case we will stop processing your personal data for these purposes without undue delay);
Right to object to automated processing, including profiling – you have the right not to be subject to a decision based solely on automated processing of your personal data, including profiling, as well as to have all the rights arising for you in case you are subject to the legal consequences of such processing;
Right to withdraw consent to processing – if we process your personal data based on your consent, at any time, you have the right to withdraw your consent. Withdrawal will not affect the lawfulness of processing based on consent before its withdrawal.

If, at the request of the User, we delete their personal data from our database, we will retain only the information that may be necessary to protect our legitimate interests or for public authorities.
You have the right to request that we inform you about all recipients to whom the personal data, for which correction, deletion, or restriction of processing has been requested, have been disclosed. We may refuse to provide this information if it is impossible or requires disproportionately large efforts.
If we are required to transfer personal data to another controller, correct or delete personal data, restrict the processing of personal data, or terminate such processing, provide information about the recipients to whom the personal data, for which correction, deletion, or restriction of processing has been requested, have been disclosed, or provide access to personal data, and in case of concerns regarding the identity of the User making the request, we may first require additional information to confirm the identity of the respective data subject.
If there is a third party involved in processing your personal data (as mentioned in part IX above), all the above requests will be forwarded to that third party.
The exercise of the above rights is free of charge for Users, except when the requests made are manifestly unfounded or excessive. In such a case, we may either impose a reasonable fee for fulfilling the request or refuse to act on the request.
Users can exercise the above rights by contacting us via email at: [email protected]

XI. COMPLAINT TO SUPERVISORY AUTHORITY

Suppose you believe that your personal data is not being processed lawfully or that any of your data protection rights have been violated. In that case, you have the right to file a complaint with the competent supervisory authority for personal data protection specified in part III above of the Privacy Policy. You also have the right to seek judicial protection of your rights.
If the Website contains links to other websites, we recommend that you carefully review the privacy policies of those other websites, as your personal data may be processed by those websites when you visit them, which processing is not covered by this Privacy Policy.
We reserve the right to change the Privacy Policy at our discretion and whenever we deem it appropriate.