Grounds for collecting, processing, and storing your personal data
Art. 1. (1) The administrator collects and processes your personal data in connection with the use of an online store https://dutchcheesecompany.com and the conclusion of contracts with the company on the basis of Art. 6, para. 1, Regulation (EU) 2016/679 (GDPR), and in particular on the basis of the following grounds:
- Explicitly obtained consent from you as a customer;
- Fulfillment of the obligations of the Administrator under a contract with you;
- Compliance with a legal obligation that applies to the Administrator;
- For the purposes of the legitimate interests of the Administrator or a third party;
Purposes and principles of collecting, processing, and storing your personal data
Art. 2. (1) We collect and process the personal data you provide to us in connection with the use of the online store https://dutchcheesecompany.com and concluding a contract with the company, including for the following purposes:
- creating an account and providing full functionality when using the online store;
- individualization of a party to the contract;
- accounting purposes;
- statistical purposes;
- protection of information security;
- ensuring the performance of the contract for the provision of the respective service;
- sending a newsletter and emails with special offers if you wish;
- sending advertising materials and samples of products from other companies if you wish;
- sending answers to inquiries made through the feedback form on our website;
(2) We comply with the following principles when processing your personal data:
- legality, good faith and transparency;
- limitation of the purposes of processing;
- relevance to the purposes of processing and minimization of the data collected;
- accuracy and timeliness of the data;
- limitation of storage in order to achieve the objectives;
- integrity and confidentiality of processing and ensuring an appropriate level of security of personal data.
(3) When processing and storing personal data, the Administrator may process and store personal data in order to protect its legitimate interests:
- fulfillment of its obligations to the National Revenue Agency, the Ministry of Interior and other state and municipal authorities.
What types of personal data our company collects, processes and stores
Art. 3. (1) The Company performs the following operations with the personal data you provide as clients for the following purposes:
- Registration of a customer in the e-shop and execution of a distance sales contract – the purpose of this operation is to create an account for the use of the e-shop for the purchase of goods and to provide contact details for the delivery of purchased goods. Registration and creation of an account for the use of the online store is not a mandatory step in the provision of the service and it is available to a significant extent without creating an account through the option “Order as a guest” – Conclusion of the impact assessment: On the basis of the impact assessment carried out, the Data Protection Officer considers that the operation “Registration of a user in the e-shop and execution of a distance sales contract” is permissible to perform and provides sufficient guarantees to protect the rights and legitimate interests of data subjects in accordance with the requirements of the GDPR;
- Sending a newsletter – the purpose of this operation is to administer the process of sending newsletters, emails with special offers, promotions, promo codes, news and new functionalities to customers who have stated that they wish to receive. Given the limited scope of the personal data collected, the Data Protection Officer considers that an impact assessment is not necessary to carry out an impact assessment of the Operation.
- Exercising the right of withdrawal or making a claim – the purpose of this operation is to administer the process of exercising the right of withdrawal or claim from the customer for the goods in respect of which these rights can be exercised. Given the limited scope of the personal data collected, the Data Protection Officer considers that it is not necessary to carry out an impact assessment of the operation.
- Provision of advertising materials and sampling by other companies – The purpose of this operation is to administer the process of sending advertising materials and product samples from other companies to customers who have stated that they wish to receive them. Given the limited scope of the personal data collected, the Data Protection Officer considers that an impact assessment of the operation is not necessary.
- Making inquiries through the feedback form on the website https://dutchcheesecompany.com – the purpose of this operation is to send a response to an inquiry. Given the limited scope of the personal data collected, the Data Protection Officer considers that an impact assessment is not necessary to carry out an impact assessment of the operation.
(2) The administrator does not collect or process personal data that relates to the following:
- reveal racial or ethnic origin;
- reveal political, religious or philosophical beliefs, or trade union membership;
- genetic and biometric data, health data or data on sexual life or sexual orientation.
(3) The personal data are collected by the Administrator from the persons to whom they relate.
(4) The administrator does not perform automated decision-making with data.
(5) The Company does not collect data on persons under 16 years of age, except with the explicit consent of their parent or legal representative.
Art. 4. (1) The administrator processes the following categories of personal data and information for the following purposes and on the following grounds:
- Your individualizing data (e-mail, name, etc.)
- Purpose for which the data is collected: 1) Contacting the user and sending information to him, 2) for the purpose of registering a user in the online store, as well as 3) sending a newsletter, emails with special offers, promotions, promo codes, news and new functionalities, and 4) sending a response to an inquiry through the form on our website.
- Grounds for processing your personal data – By accepting the general terms and conditions and registering in the e-shop or placing an order without registration, or upon entering into a written contract, a contractual relationship is created between the Administrator and you, on which basis we process your personal data – Art. 6, para. 1, b. (b) GDPR. Your data for sending a newsletter and emails, as well as for sending a response to a request through the form on our website, are processed with your explicit consent – Art. 6, para. 1, b. (a) GDPR.
- Delivery data (names, telephone, address, etc.)
- Purpose for which the data is collected: 1) Fulfillment of obligations of the administrator under a contract for the purchase and sale and delivery of the purchased goods and 2) Sending advertising materials and samples of products from other companies through “Events” AD to the customers who have stated that they wish to receive them.
- Grounds for processing your personal data – By accepting the general terms and conditions and registering in the e-shop or placing an order without registration, or upon concluding a written contract, a contractual relationship is created between the Administrator and you, on which basis we process your personal data – Art. 6, para. 1, b. (b) GDPR.
Your data for sending advertising materials and samples of products are processed on the basis of your explicit consent – Art. 6 para. 6, para. 1, b. (a) GDPR.
- Data from your social media profiles (publicly available information from your profiles)
- The purpose for which the data is collected: 1) to contact the user and send information to him and 2) for the purpose of registering a user in the online store.
- Grounds for processing your personal data – By accepting the general terms and conditions and registering in the e-shop through a social network account, a contractual relationship is created between the Administrator and you, on which basis we process your personal data – Art. 6, para. 1, b. (b) GDPR.
Period of storage of your personal data
Art. 5. (1) The administrator stores your personal data for a period no longer than the existence of your account in the online store or the execution of the order “as a guest”. After deleting your account or completing the order, the Administrator takes the necessary care to delete and destroy all your data without undue delay or to anonymize them (i.e. to bring them into a form that who does not reveal your personality).
(2) The Administrator shall store your personal data provided in connection with online orders for a period of 5 years for the purpose of protecting the legal interests of the Administrator in judicial or administrative disputes with users of the online store, and the accounting documents are kept for the relevant statutory period.
(3) The Administrator shall notify you in the event that the data retention period needs to be extended in order to comply with a statutory obligation or in view of the legitimate interests of the Administrator or otherwise.
(4) The administrator shall store the personal data that it is necessary to keep under the applicable legislation for the relevant period of time, which may exceed the duration of your e-shop account or until the order is completed.
Art. 6. (1) The Administrator shall store the personal data of the legal representatives of its trading partners for the period of performance of the contract, for compliance with the legitimate interests and legal obligations of the Administrator, and this period may exceed the term of the contract.
Transfer of your personal data for processing
Art. 7. (1) The administrator may, at its own discretion, transmit part or all of your personal data to processors for the fulfillment of the processing purposes to which you have agreed, subject to the requirements of Regulation (EU) 2016/679 (GDPR).
(2) The administrator notifies you in case of intent to transfer part or all of your personal data to third countries or international organizations.
Your rights in the collection, processing and storage of your personal data
Withdrawal of consent to the processing of your personal data
Art. 8. (1) If you do not wish all or part of your personal data to continue to be processed by the Company for any or all processing purposes, you may at any time withdraw your consent to processing by filling in the form in your account or by a request in free text.
(2) The administrator may ask you to certify your identity and identity with the person to whom the data relate.
(3) By withdrawing your consent to the processing of personal data that is mandatory for creating and maintaining an account in the online store, your account will become inactive. Of course, you will be able to browse the online store and the products offered and make guest orders or make a new registration.
(4) If there is an order you are currently processing, the earliest point at which you can withdraw your consent to processing is when the order is successfully completed.
(5) You may at any time withdraw your consent to the processing of your personal data for direct marketing purposes.
(6) The withdrawal of consent does not affect the lawfulness of the processing of personal data that the Administrator has carried out so far.
Right of access
Art. 9. (1) You have the right to request and obtain from the Administrator confirmation as to whether or not personal data concerning you are being processed, and you may at any time see in your profile, if you are a registered user, the data we process for you.
(2) You have the right to obtain access to the data relating to you as well as to the information relating to the collection, processing and storage of your personal data.
(3) The Administrator shall provide you, upon request, with a copy of the processed personal data relating to you in electronic or other appropriate form.
(4) Providing access to the data is free of charge, but the Administrator reserves the right to impose an administrative fee in case of repeatability or excessiveness of the requests.
Right to rectification or completion
Art. 10. You may correct or fill in the inaccurate or incomplete personal data relating to you directly through your website account or by sending a request to the Administrator.
Right to erasure (‘right to be forgotten’)
Art. 11. (1) You have the right to request from the Administrator the deletion of part or all of the personal data relating to you, and the Administrator has the obligation to delete them without undue delay where one of the following grounds applies:
- The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
- You withdraw your consent on which the processing is based and there is no other legal basis for the processing;
- You object to the processing of personal data relating to you, including for direct marketing purposes, and there are no overriding legitimate grounds for the processing;
- the personal data have been unlawfully processed;
- The personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.
- the personal data have been collected in relation to the offer of information society services.
(2) The administrator is not obliged to delete personal data if he stores and processes them:
- (a) exercising the right to freedom of expression and information;
- for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
- for reasons of public interest in the field of public health;
- for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes;
- for the establishment, exercise or defense of legal claims.
(3) In case of exercising your right to be forgotten, the Company will delete all your data except for the following information:
- information that is necessary to certify that your right to be forgotten is fulfilled – email, IP address;
- technical information about the functioning of the online store, which information can not be associated in any way with your personality;
- e-mail with which you have registered in the online store.
(4) In order to exercise your right to be forgotten, you need to take the following steps:
- Submit a request through your online store account or by email;
- Provide a unique identification code for performing the action, which will be sent to you by email to the email address associated with the registration in the online store;
- Identify yourself as an account holder;
(5) Once we have certified the identity of the person who made the request and the person to whom the data relates in accordance with the steps mentioned above, we will delete all data we process about you in accordance with para. 3.
(6) If there is an order you are currently processing, the earliest point at which you can ask to be “forgotten” is when the order is successfully completed.
(7) By deleting your personal data, your account will become inactive. Of course, you will be able to browse the online store and the products offered and make orders as a guest or make a new registration.
(8) The administrator does not delete the data that he has a legal obligation to store, including for protection against claims brought against him or proof of his rights.
Right to restriction
Art. 12. (1) You have the right to require the Administrator to restrict the processing of data related to you when:
- the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
- the processing is unlawful, but you do not want the personal data to be erased, only to restrict their use;
- The controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims.
- You have objected to the processing pending verification whether the legitimate grounds of the Administrator override your interests.
(2) In the event of exercising your right of restriction, the Company will cease processing your data, but will not remove the publications you have made in the online store.
Right to portability
Art. 13. (1) If you have consented to the processing of your personal data or the processing is necessary for the performance of the contract with the Administrator, or if your data is processed in an automated manner, you may, after you have identified yourself before the Administrator:
- ask the Administrator to provide you with your personal data in a readable format and transfer it to another Administrator;
- ask the Administrator to directly transfer your personal data to an administrator you specify, where technically feasible.
(2) You may at any time download or receive in a machine-readable format the data that is stored and processed for you in connection with the use of the Administrator’s services, directly through your account through the data export option or by email request.
Right to receive information
Art. 14. You may request the Administrator to inform you of all recipients to whom the personal data for which rectification, erasure or restriction of processing has been requested have been disclosed. The administrator may refuse to provide this information if this would be impossible or would require disproportionate effort.
Right to object
Art. 15. You may object at any time to the processing of personal data by the Administrator concerning him, including if they are processed for profiling or direct marketing purposes.
Your rights in case of violation of the security of your personal data
Art. 16. (1) If the Administrator detects a breach of security of your personal data, which may pose a high risk to your rights and freedoms, he shall notify you without undue delay of the violation as well as of the measures taken or to be taken.
(2) The administrator is not obliged to notify you if:
- has taken appropriate technical and organizational protection measures with respect to the data affected by the security breach;
- has subsequently taken measures to ensure that the breach will not lead to a high risk for your rights;
- notification would require a disproportionate effort.
Persons to whom your personal data is provided
Art. 17. For the purposes of processing your personal data and providing the service in its full functionality and in view of your interests, the Administrator may provide your data to the following personal data processors:
| Data processor | Purpose of the processing of personal data |
| Supplier | Delivery to an address |
These personal data processors comply with all requirements for legality and security when processing and storing your personal data.
Other provisions
Art. 18. The administrator does not transfer your data to third countries.
Art. 19. In case of violation of your rights under the above or applicable data protection laws, you have the right to file a complaint with the Personal Data Protection Commission as follows:
| Name | Commission for Personal Data Protection |
| Headquarters | Sofia, 1592, 2 prof. Tsvetan Lazarov blvd. |
| Contact Address | Sofia, 1592, 2 prof. Tsvetan Lazarov blvd. |
| Phone Number | +3592/91-53-518 |
| Website | www.cpdp.bg |
Art. 20. You can exercise all your rights to protect your personal data through the forms attached to this information or through the functionalities in your profile. Of course, these forms are not mandatory and you can make your requests in any form that contains a statement about it and identifies you as the data holder.
Art. 21. If the consent concerns a transfer, the Administrator shall describe the possible risks for the transfer of data to third countries in the absence of a decision on adequate protection and appropriate remedies.
Art. 22. The Company may amend the Privacy Policy by posting a notice on its website.
Cookie Policy
What’s a cookie?
A “cookie” is a piece of information that is stored on your computer’s hard drive if you agree to this and which records how you move your way around a website so that, when you revisit that website, it can present tailored options based on the information stored about your last visit. Cookies can also be used to analyze traffic and for advertising and marketing purposes.
Cookies are used by nearly all websites and do not harm your system.
We are required to obtain your consent for all non-essential cookies used on our website. You can block cookies (including essential cookies) at any time by activating the setting on your browser that allows you to refuse the setting of all or some cookies. However, if you use your browser settings to block essential cookies you may not be able to access all or parts of our site.
How do we use cookies?
We use cookies to track your use of our website. This enables us to understand how you use the site and track any patterns with regards how you are using our website. This helps us to develop and improve our website as well as products and / or services in response to what you might need or want.
Cookies are either:
– Session cookies: these are only stored on your computer during your web session and are automatically deleted when you close your browser – they usually store an anonymous session ID allowing you to browse a website without having to log in to each page but they do not collect any personal data from your computer; or
– Persistent cookies: a persistent cookie is stored as a file on your computer and it remains there when you close your web browser. The cookie can be read by the website that created it when you visit that website again. We use persistent cookies for Google Analytics.
Cookies can also be categorized as follows:
– Strictly necessary cookies: These cookies are essential to enable you to use the website effectively, such as when buying a product and / or service. Without these cookies, the services available to you on our website cannot be provided. These cookies do not gather information about you that could be used for marketing or remembering where you have been on the internet.
– Performance cookies: These cookies enable us to monitor and improve the performance of our website. For example, they allow us to count visits, identify traffic sources and see which parts of the site are most popular.
– Functionality cookies: These cookies allow our website to remember choices you make and provide enhanced features. For instance, we may be able to provide you with news or updates relevant to the services you use. They may also be used to provide services you have requested such as viewing a video or commenting on a blog. The information these cookies collect is usually anonymized.
– Targeting cookies: These cookies record your visit to our website, the pages you have visited and the links you have followed. We will use this information to make our website and the advertising displayed on it more relevant to your interests.
– First and third party cookies: First party cookies are cookies set by our website. Third party cookies are cookies on our website that are set by a website other than our website, such as where we have adverts on our website or use Facebook pixels so that we can show you relevant content from us when you are on Facebook.
You can find more information about the individual cookies we use (including third party cookies) and the purposes for which we use them in the table below:
You can alter your cookie preferences at any time by changing the settings on our cookie consent tool. Please refresh your page to ensure that the new setting have taken effect.
Note – if the cookie consent tool does not appear on our site, open our site on a new page in an incognito browser.
You can also control your cookie setting through your web browser.
You can opt out of being tracked by Google Analytics across all websites, by going to http://tools.google.com/dlpage/gaoptout. If you have any questions about the cookies that we use, fell free to email us at our contact us page.
