Privacy Policy
Privacy Policy of "Elephant Bookstore" Ltd.
1. Introduction
This Privacy Policy governs how "Elephant Bookstore" Ltd. collects, processes, and stores personal data in accordance with the requirements of the Bulgarian Personal Data Protection Act, the General Data Protection Regulation (EU) 2016/679, and other applicable Bulgarian and international laws.
Protecting your privacy is a priority for "Elephant Bookstore" Ltd. As a data controller, we adhere to legal standards and best practices, ensuring the required technical and organizational measures to protect the personal data of individuals.
This policy provides information on how and what types of personal data we collect, why it is needed, to whom it may be disclosed, and how it is protected. By providing your personal data to "Elephant Bookstore" Ltd., whether electronically or on paper, you agree to the practices described in this policy. If you have any questions or concerns regarding this policy, please contact us.
2. Information about "Elephant Bookstore" Ltd. as a Data Controller
For inquiries regarding your personal data, you can contact us at:
Name: "Elephant Bookstore" Ltd. Address: Bulgaria, Sofia 1000, 31 Ivan Shishman St. Email: info@elephantbookstore.com Website: www.elephantbookstore.com
3. Legal Basis
This Privacy Policy is issued based on the Bulgarian Personal Data Protection Act and the General Data Protection Regulation (EU) 2016/679 (GDPR). Bulgarian law and GDPR outline the rules on how "Elephant Bookstore" Ltd. should collect, process, and store personal data.
"Elephant Bookstore" Ltd. ensures lawful and transparent data processing, securing operations, and preventing unauthorized disclosure. The company adheres to key principles, ensuring personal data is:
• Processed lawfully, fairly, and transparently.
• Collected for specified, legitimate purposes.
• Accurate, relevant, and updated as necessary.
• Stored for no longer than necessary.
• Secured against unauthorized or unlawful processing and accidental loss, destruction, or damage.
4. Policy Objectives
This policy outlines the rules for protecting individuals' rights in data processing, ensuring compliance with GDPR and Bulgarian legislation.
"Elephant Bookstore" Ltd. aims to ensure:
• Lawful data processing.
• Protection of individuals' rights under GDPR.
• Compliance with data protection requirements for secure processing, risk assessment, and third-party processing.
5. Scope
To provide effective access to the online store, the company collects, processes, and stores the following personal data:
• Username, email, and password for registration.
• Names, address, email, and phone for purchasing products.
• Device and demographic information when accessing the website.
• Cookies for browsing personalization.
6. Categories of Data Subjects
• Customers, contractors, employees.
7. Purpose of Data Processing
Data is processed for communication transparency, contract execution, legal compliance, and to safeguard the company's rights and interests. Data may also be processed for sending newsletters and marketing communications with explicit consent.
For online purchases, both registered and guest users' data is collected solely for processing the order. Users can subscribe to newsletters, and data protection regulations are followed accordingly.
7. Purposes of Personal Data Processing
• In accordance with the requirements of Section I - Transparency and Conditions from the General Data Protection Regulation (EU) 2016/679, "Elephant Bookstore" Ltd. provides transparent information, communication, and conditions for exercising the rights of data subjects as per Article 12 of the Regulation.
• Data may also be processed to protect and preserve the rights of the Company. Specifically, there may be instances where the Company may disclose the data if such disclosure is necessary (a) to protect, exercise, or preserve the legitimate rights, privacy, safety, or property of the Company, its employees, intermediaries, and contractors; (b) to protect the Company against fraud; or (c) for the purposes of risk management.
• Your personal data will be processed and stored for purposes necessary for the conclusion and execution of the contract for the provision of services related to your order; for purposes necessary to protect and enforce the legitimate interests of "Elephant Bookstore" Ltd.; and for purposes related to compliance with the legal obligations of the Data Controller. These purposes are related to the legitimate interests of "Elephant Bookstore" Ltd., such as: ensuring the normal functioning and use of the Website by you and other users; maintenance and administration of the Services; resolving disputes; detecting and preventing malicious actions; identifying and resolving technical or functional issues; developing and improving the Services; communicating with you, including electronically, on important matters related to the Services; and enforcing and protecting the rights and legitimate interests of "Elephant Bookstore" Ltd., including through legal proceedings. For these purposes, it may be necessary to process part or all of the above-mentioned categories of data.
• The purposes and information regarding the processing of personal data carried out by "Elephant Bookstore" Ltd. are provided in accordance with the performance of the core processes of the Company.
• Only with your explicit consent will we send you (via email, SMS, phone, chat, and social media) offers, promotions, and other marketing communications related to the Company’s services, services/products of related entities, and/or partner organizations operating in the area of the Company’s business, specifically products offered by us, including those from our related companies and branded or co-branded services and functions conducted jointly with a partner organization or related entity.
Upon Contract Conclusion
By clicking the "Login/Register" button when registering as a "New Client," you provide personal data such as: First Name, Last Name, email address, contact phone number, your address, and you are given the opportunity to consent to and read this Privacy Policy. By confirming the registration email, you make an electronic statement, thereby entering into a contract with us under these Terms and agreeing to comply with them. Before clicking the "Confirm Order" button, you have the opportunity to review and edit the information you have provided. You agree that electronic statements to "Elephant Bookstore" Ltd. and our electronic statements to you are considered signed with an ordinary electronic signature in accordance with Article 3, paragraph 10 of Regulation (EU) No. 910/2014, with the same effect as a handwritten signature.
By consenting to registration and completing your order, you agree that "Elephant Bookstore" Ltd. may use the personal data you provided – as mentioned above. If you request an invoice, you must give explicit consent for "Elephant Bookstore" Ltd. to use the necessary data for its issuance.
Additionally, "Elephant Bookstore" Ltd. stores information about the registration and agreement with the Terms (IP address, date, time), as well as maintaining a log of the fact of sending the statement (without its content) for the period specified in this policy. The log contains the date of the statement, the name and email address of the sender, and the identification of the recipient. In the processing of your personal data, you will not be subject to a decision based solely on automated processing, including profiling.
Purpose: Conclusion and Execution of a Contract
These are the purposes necessary for the steps of concluding and executing the contract between you and "Elephant Bookstore" Ltd., including the necessary data processing for registration, account creation, and the activities related to fulfilling your order. Additionally, these purposes include communication with you, including via email, necessary for the provision of services and/or notifying you of changes to the services provided. For this purpose, it may be necessary to process part or all of the above-mentioned categories of data.
When Receiving a Newsletter
On our website, you can subscribe to a newsletter. The data provided during the subscription will only be used for sending the newsletter. You can cancel your subscription at any time through the provided opt-out option. To confirm your consent for receiving the newsletter and processing your personal data for this purpose, please familiarize yourself in detail with who we are and the purposes and duration for which we process your personal data.
By consenting to the newsletter registration, you agree that "Elephant Bookstore" Ltd., located at Bulgaria, Sofia 1000, Ivan Shishman St. No. 31, hereinafter referred to as the Data Controller, may use the personal data you provided – email address and IP address – to send you a newsletter with up-to-date information about promotions, games, and/or activities of the Company. You may withdraw your consent for receiving the newsletter at any time by unsubscribing via the "Unsubscribe" link at the bottom of every message.
When Processing Personal Data for Shopping Through the Online Store and Visiting the Website
On our website, you can shop online. You can use this service with or without registration. The data provided in both cases will be used solely for the purpose of carrying out the activities related to your order. Additionally, you have the option to subscribe to our newsletter, and the lack of consent for this does not prevent you from becoming a customer of our online store. Please familiarize yourself in detail with who we are and the purposes and duration for which we process your personal data before registering.
9. Transparency. Rights of Data Subjects Whose Data is Processed by "Elephant Bookstore" Ltd.:
• Right to confirmation of processing and access to your personal data;
• Right to correct inaccurate or incomplete personal data;
• Right to request the deletion of your personal data;
• Right to request the restriction of the processing of your personal data;
• Right to be notified of any action related to correcting, deleting, or restricting the processing;
• Right to object at any time to the processing of your personal data: a. For the performance of a task carried out in the public interest or based on official authority, or for legitimate interests, including profiling; b. For processing for direct marketing purposes; c. For processing for scientific or historical research purposes or for statistical purposes.
• Right to refuse to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or significantly affects you.
• Right to receive your personal data;
• Right to file a complaint with the Commission for Personal Data Protection for violations of Regulation (EU) No. 2016/679 of April 27, 2016, and the right to effective protection against the CPDP, the controller, or the processor of your personal data;
• Right to compensation for material or non-material damages suffered as a result of a violation of Regulation (EU) No. 2016/679.
All personal data subjects (clients, users, or employees, where such data has become known to partners or suppliers, as described in the processing activity registers) have the right to exercise their rights in person, by phone, or online at the specified contact address for "Elephant Bookstore" Ltd.
To exercise your rights as specified above, please contact us at our email address info@elephantbookstore.com or at the address: Bulgaria, Sofia 1000, Ivan Shishman St. No. 31.
Requests regarding personal data will be responded to within one month, and in case of the need for an extension of the specified period, you will be informed of the extension as well as the reasons for the delay. We may refuse to process requests that are unreasonably repetitive or that threaten the privacy of other users.
10. Provision of Personal Data and Consequences of Refusing to Provide It:
The data subject has the right to refuse to provide their data to the relevant authority or to withdraw their consent for the processing of personal data at any time through a separate request made to the data controller. This could hinder "Elephant Bookstore" Ltd. from fulfilling its statutory obligations.
11. Transfer of Personal Data to Third Countries or International Organizations:
The transfer of personal data, which is processed or intended to be processed, to a third country or an international organization outside the EU is carried out by "Elephant Bookstore" Ltd. only under the conditions of the General Data Protection Regulation (Regulation (EU) 2016/679), while complying with the conditions specified in Chapter V of the Regulation.
"Elephant Bookstore" Ltd. applies all provisions of the Regulation to avoid exposing the necessary level of protection of individuals ensured by the Regulation to risk.
If "Elephant Bookstore" Ltd. undertakes to transfer personal data to a third country or an international organization outside the EU, this transfer is carried out in compliance with the requirements for data transfer outside the EU. Data subjects are notified in advance in the appropriate manner.
12. Social Networks and Social Plugins:
Through our profiles and pages on social networks, we offer you extensive personal assistance. If you send us a query through one of these social networks, we forward it to a staff member. The data is used only to respond to your query and is not shared with third parties. The legal basis for processing personal data in the context of handling your query is Article 6(1)(e) of Regulation (EU) 2016/679. To contact us through social networks, you need to have an account with them. The companies behind each network process personal data when necessary. We have no influence over the type, scope, and processing of this data.
13. Retention Period of Your Personal Data:
1. The company will store your personal data as long as your profile in the online store exists. After its deletion, the Controller must take the necessary steps to delete this data without undue delay, provided the law allows this.
2. Data provided in connection with online orders are retained by the Controller for a period of 5 years for the purpose of protecting the legal interests of "Elephant Bookstore" Ltd. in legal or administrative disputes with users of the online store. If your personal data is contained in accounting documents on paper or electronic media, which "Elephant Bookstore" Ltd. may be required to provide for tax control purposes, the retention period for this personal data will be 10 years.
3. If the retention period of the data needs to be extended to comply with a regulatory obligation or for the legitimate interests of the Company, the Company is obliged to inform you of the specific extension and the basis for it.
4. Data provided when filling out the contact form on the online store or submitting a request to "Elephant Bookstore" Ltd. is retained for a period of 2 months for security purposes and to facilitate further communication with the user, unless there is a basis for applying a longer period.
14. Breaches and Notification of Breaches:
A "personal data security breach" means a security breach that leads to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data that is transmitted, stored, or otherwise processed by "Elephant Bookstore" Ltd.
In the event of a personal data security breach, the Data Controller must be immediately notified at the contact address for "Elephant Bookstore" Ltd.
If a personal data security breach is likely to pose a risk to the rights and freedoms of individuals, "Elephant Bookstore" Ltd. will notify the Data Protection Commission of the breach without undue delay and, where feasible, no later than 72 hours after becoming aware of it.
If a specific breach poses a risk to the rights and freedoms of individuals, "Elephant Bookstore" Ltd. will take measures to notify the affected individuals to minimize potential adverse consequences.
"Elephant Bookstore" Ltd. takes actions in accordance with the "Procedure for Personal Data Security Breach."
15. Destruction of Personal Data:
If necessary, "Elephant Bookstore" Ltd. follows the "Procedure for Retention and Destruction of Personal Data."
16. "Elephant Bookstore" Ltd. is not responsible for the content and safety of websites to which links are published on our site. Clicking on such links and using the websites to which they refer is done entirely at the user's own risk and responsibility.
17. Right to Lodge a Complaint with a Supervisory Authority:
• If you believe that your personal data rights have been violated, please contact "Elephant Bookstore" Ltd. so the Controller can resolve the issue.
• You can also contact the local data protection authorities and file a complaint with them. In Bulgaria, this is the Commission for Personal Data Protection:
Address: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.
Website: www.cpdp.bg
Email: kzld@cpdp.bg
Tel.: +359 2 9153518
18. Changes to the Privacy Policy:
"Elephant Bookstore" Ltd. reserves the right to update, amend, and supplement the personal data protection policy at any time in the future when circumstances require it.
