Privacy Policy

1. Who We Are

“PAPAZOV-NIK” Ltd. is a company registered in the Republic of Bulgaria, with its registered seat and management address at: 37 Marmarliyska Str., West Block, Entrance G, Office 1G, Veliko Tarnovo, Bulgaria, UIC: 104608192, Tel.: +359 888 234 090, Email: office@papazov-nik.bg

In connection with its business activities – production and trade of additives for the food industry – “PAPAZOV-NIK” Ltd. (the “Company”) processes data, some of which constitute personal data within the meaning of the Personal Data Protection Act and Regulation (EU) 2016/679. Therefore, the Company acts as a personal data controller.
This Policy aims to inform users of www.papazov-nik.bg about how their personal data are processed, their rights, the methods of personal data protection applied by the controller, to whom the Company may disclose collected personal data, and how data subjects may exercise their rights.


2. Introduction

GDPR is the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council). The Regulation significantly increases the rights of European citizens and imposes additional obligations on organizations that collect and process personal data. It entered into force on 25 May 2018 and applies in all Member States of the European Union.
Personal data are collected for specific, explicitly stated and legitimate purposes and are not further processed in a manner incompatible with those purposes. Processing is carried out lawfully, fairly, and transparently in relation to the data subject.


3. Purpose and Scope of the Policy

With this Personal Data Protection Policy, “PAPAZOV-NIK” Ltd. recognizes the confidentiality and integrity of personal data. In compliance with legislation and good practices, the Company implements the required technical and organizational measures to protect personal data of individuals.

Through this Policy, the Company aims to inform individuals about the purposes of processing personal data, the recipients or categories of recipients to whom the data may be disclosed, whether providing data is mandatory or voluntary and the consequences of refusal, as well as information about the right of access and correction of collected data.


4. Definitions

“Personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

“Genetic data” means personal data relating to inherited or acquired genetic characteristics of a natural person which give unique information about that person’s physiology or health and which result, in particular, from an analysis of a biological sample from the person concerned.

“Biometric data” means personal data resulting from specific technical processing relating to the physical, physiological or behavioral characteristics of a natural person, which allow or confirm the unique identification of that person, such as facial images or fingerprint data.

“Consent of the data subject” means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

“Processing” means any operation or set of operations performed on personal data or on sets of personal data, whether by automated means or not, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

“Controller” means a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of processing personal data.

“Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

“Representative” means a natural or legal person established in the Union who, designated by the controller or processor in writing pursuant to Article 27 of Regulation (EU) 2016/679, represents the controller or processor with regard to their respective obligations under the Regulation.

“Recipient” means a natural or legal person, public authority, agency or another body to which personal data are disclosed, whether a third party or not.

“Supervisory authority” means an independent public authority established by a Member State responsible for monitoring the application of Regulation (EU) 2016/679.

“Personal data breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed.

“Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person.


5. Main Principles Related to Personal Data Processing

- Lawfulness, fairness and transparency;
- Purpose limitation;
- Data minimization;
- Accuracy and keeping data up to date;
- Storage limitation;
Integrity and confidentiality;
- Accountability.


6. Purpose of Processing

“PAPAZOV-NIK” Ltd. processes personal data for the purpose of carrying out its activities – production and trade of additives for the food industry.
The Company does not collect personal data for marketing and advertising purposes. The data collected are provided solely with the explicit, free, clear and informed consent of the user.
The Company does not process personal data for automated decision-making, including profiling.


7. The Company Processes Personal Data Only When

- It has obtained clear, free, informed and unambiguous consent from the data subject;
- Processing is necessary for the performance of a contract;
- Processing is necessary for compliance with a legal obligation or for the performance of a task carried out in the public interest.


8. What Data Are Collected and Processed

Important: “PAPAZOV-NIK” Ltd. does not collect or process sensitive personal data of its customers and website users.
The data collected may include:
- First and last name;
- Email address;
- Telephone number;
Other data permitted under the Regulation, if necessary.
The data subject has the right not to provide certain personal data; however, in such cases the Company may not be able to fulfill the requested service.


9. Recipients of Personal Data

The Company provides personal data to competent state authorities and institutions when required by law.
Personal data of website users are not disclosed to third parties outside legal requirements. The Company does not transfer personal data outside the European Union.


10. Rights of Data Subjects

- Right of access;
- Right to rectification;
- Right to erasure (“right to be forgotten”);
- Right to restriction of processing;
- Right to data portability;
- Right to object;
- Right to lodge a complaint with the Personal Data Protection Commission or the competent court;
- Right not to be subject to automated decision-making, including profiling.


11. Data Retention Period

The Company processes data in accordance with applicable legislation and the principle of storage limitation.
Data submitted through the website contact form are stored for 6 months or as long as necessary to respond to the inquiry.
Employee data are stored for longer periods in accordance with accounting and labor legislation.


12. Responsibility for Data Protection

The Company applies all necessary organizational and technical measures to ensure adequate protection of personal data, both in electronic and paper form.
Access to files containing personal data is granted only to authorized employees. Licensed software systems are used, and password security policies are strictly implemented.


13. Changes to the Policy

The Company reserves the right to update, amend or supplement this Personal Data Protection Policy at any time when circumstances require it.


14. Contact Details of the Data Controller

Address: 37 Marmarliyska Str., West Block, Entrance G, Office 1G, Veliko Tarnovo, Bulgaria
Phone: +359 888 234 090
Email: office@papazov-nik.bg

Supervisory Authority:
The national supervisory authority is the Commission for Personal Data Protection.
Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia, Bulgaria
Phone: +359 2 91 53 555
Email: kzld@cpdp.bg
Website: www.cpdp.bg