Mandatory information regarding individuals’ rights under data protection legislation (Privacy notice)

General information

On 25 May 2018, a new General Data Protection Regulation, adopted by the European Union, comes into force. The Regulation aims to ensure the protection of individuals’ data across all EU Member States and to harmonise the rules governing the processing of such data.

In our capacity as a data controller in relation to the goods and services offered for sale on the website, bluebag.coffee It complies with all the requirements of the new regulation, collecting only such personal data as is necessary for the provision of the service, and storing it in a responsible and lawful manner.

Information regarding the Data Controller

1. Company name: „Blue Bag“ Ltd
2. EIK/BULSTAT: 207270018
3. Registered office and business address: Sofia 1528, 7 Amsterdam Street
4. Business address: Sofia, 1528 Iskar Oil Refinery, 7 Amsterdam Street
5. Correspondence details: Sofia, 1528 Iskar Oil Refinery, 7 Amsterdam Street
6. E-mail: info@bluebag.coffee
7. Tel.: 0878 580 171 / 0878 367638
8. Personal Data Controller Certificate No. 1443380

Information regarding the Data Protection Officer

1. Title: “Deyan Georgiev“
2. EIK/BULSTAT: 207270018
3. Registered office and business address: 7 Amsterdam Street, Sofia 1528.
4. Correspondence details: Sofia, 1528 Iskar Oil Refinery, 7 Amsterdam Street
5. Telephone: 0878580171
6. Email: info@bluebag.coffee

Information regarding the competent supervisory authority

1. Name: Commission for Personal Data Protection
2. Registered office and business address: Sofia 1592, 2 Prof. Tsvetan Lazarov Boulevard
3. Correspondence details: Sofia 1592, 2 Prof. Tsvetan Lazarov Boulevard
4. Telephone: 02 915 3 518
5. Email: kzld@government.bg, kzld@cpdp.bg
6. Website: cpdp.bg

„bluebag.coffee“carries out its activities in accordance with the Personal Data Protection Act and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

Legal basis for the collection, processing and storage of your personal data

Article 1. (1) bluebag.coffee (Blue Bag Ltd) collects and processes your personal data in connection with the provision of services, the sale of goods in physical and online environments, and the conclusion of contracts with the company on the basis of Article 6(1) of Regulation (EU) 2016/679, and more specifically on the following grounds:

• Explicit consent given by you as a customer;
• Fulfilment of the obligations of Blue Bag Ltd as set out in your contract;
• Compliance with a legal obligation applicable to Blue Bag Ltd
• For the purposes of the legitimate interest of Blue Bag Ltd;

(2) Blue Bag Ltd is the data controller in respect of your data as users of our services/products. With regard to the personal data that you process when using our online shop, bluebag.coffee acts in its capacity as a data controller.

Purposes and principles governing the collection, processing and storage of your personal data

Article 2. (1) bluebag.coffee We collect and process the personal data you provide to us in connection with your use of our online shop and for the purpose of entering into a contract with the company, as well as for registering to take part in our events, including for the following purposes:

• to create a profile and ensure full functionality when selling our products online and at our shop at 7 Amsterdam Street, Sofia 1528
• identification of a contracting party;
• registration of a participant in an event organised by Blue Bag Ltd;
• for accounting purposes;
• statistical purposes;
• information security;
• to ensure the performance of the contract for the provision of the relevant service/product;
• sending information messages, notifications regarding changes to the service or available stock, recommendations on how to make better use of the platform or the product, new and upgraded subscription plans, promotions, etc.
• to enhance and personalise each purchase by offering you tailored renewal offers, events and other products and services that may be of interest to you;
• provision of technical support via our contact form;

 (2) bluebag.coffee adheres to the following principles when processing your personal data:

• legality, good faith and transparency;
• limitation of the purposes of processing;
• proportionality to the purposes of the processing and minimisation of the data collected;
• accuracy and timeliness of the data;
• storage restrictions with a view to achieving the objectives;
• the integrity and confidentiality of the processing and ensuring an appropriate level of security for personal data.

(3) When processing and storing personal data, bluebag.coffee may process and store personal data for the purpose of safeguarding its legitimate interests as follows:

• fulfilling its obligations to the National Revenue Agency, the Ministry of the Interior and other state and local authorities.

What types of personal data does bluebag.coffee collect, process and store?

Article 3. (1) bluebag.coffee carries out the following operations on personal data for the following purposes:

• User registration on the website and fulfilment of a contract for the provision of products/services. The purpose of this operation is for the user to provide their Name, Telephone Number and Delivery Address for the product they have ordered via our online shop bluebag.coffee. 
• By accepting the terms and conditions when placing an order via our online shop or when placing an order by telephone, the Customer/User agrees to the terms and conditions. On the basis of the aforementioned impact assessment, the Data Protection Officer considers that the processing operation „Conclusion of a contract for the supply of goods/services“ is permissible and provides sufficient safeguards to protect the rights and legitimate interests of data subjects in accordance with the requirements of the GDPR.
• Concluding and fulfilling a commercial transaction with a customer or partner – the purpose of this operation is to conclude and fulfil a contract with a commercial partner or customer and to manage it;
• Sending information messages – the purpose of this activity is to manage the process of sending messages to customers regarding improvements or changes to services or products.
• Sending a newsletter – the purpose of this operation is to manage the process of sending newsletters to customers who have indicated that they wish to receive this information;

 (2) bluebag.coffee processes the following categories of personal data and information for the following purposes and on the following grounds:

• Data: Your personal details (first name and surname, email address, country, telephone number)

  • Purpose for which the data is collected:1) User registration; 2) Establishing contact with the user and sending information to them, including – where they have expressed a wish to receive them – newsletters and promotional messages;
  • Legal basis for the processing of your personal data – By accepting the terms and conditions, registering on the website and purchasing a service or product, between eu and a contractual relationship is established with you, on the basis of which we process your personal data – Article 6(1)(b) of the GDPR.

• Additional data provided by you– If you wish to add further details to your profile, you can enter your address and email address for technical support.

  • Purpose for which the data is collected:Updating the user’s details in their user account.
  • Grounds for data processing:By accepting the general terms and conditions, registering on the website and purchasing goods or services, between eu and a contractual relationship is established with you, on the basis of which we process your personal data – Article 6(1)(b) of the GDPR.

• Other data processed by bluebag.coffee– When you visit our website or log in to your account, bluebag.coffee collects data on the IP address used.

  • Purpose for which the data is collected:Improving the security of the service and localising the interface, as well as conducting statistical and marketing research.
  • Grounds for data processing:Processing is necessary for the performance of a contract to which the data subject is a party – Article 6(1)(b) of the GDPR. Until a user profile is created, the IP address is collected on the basis of the controller’s legitimate interests – Article 6(1)(f) of the GDPR;

• Your details for issuing an invoice to a private individual– If you would like an invoice to be issued to you as a private individual, you must provide your first name and surname.

  • Purpose for which the data is collected:Issuing an invoice for payments made under a contract for the supply of goods and/or services.
  • Legal basis for the processing of your personal data– By accepting the general terms and conditions and registering on the website, or upon entering into a written contract between Blue Bag Ltd and a contractual relationship is established with you, on the basis of which we process your personal data – Article 6(1)(b) of the GDPR.

(3) Blue Bag Ltd does not collect or process personal data relating to the following:

• reveal racial or ethnic origin;
• reveal political, religious or philosophical beliefs, or membership of trade unions;
• genetic and biometric data, data relating to health, or data relating to a person’s sex life or sexual orientation.

(4) Personal data has been collected from Blue Bag Ltd by the persons to whom they relate.

(5) The company does not carry out automated decision-making based on data.

Retention period for your personal data

Article 4. (1) Blue Bag Ltd We retain your personal data for a period of 10 years. Once this period has expired, Blue Bag Ltd takes the necessary steps to delete and destroy all your data without undue delay.

(2) Blue Bag Ltd We will notify you should it be necessary to extend the data retention period in order to fulfil the purposes, to perform the contract, or to safeguard the legitimate interests of bluebag.coffee or something else.

(3) Blue Bag Ltd stores the personal data that it is required to retain under applicable legislation for the relevant period specified, which may exceed the duration of your registration with our online shop: bluebag.coffee.

Transfer of your personal data for processing

Article 5. (1) Blue Bag Ltd may, at its discretion, transfer some or all of your personal data to data processors for the purposes of processing, in compliance with the requirements of Regulation (EU) 2016/679.

(2) Blue Bag Ltd It will notify you should it intend to transfer some or all of your personal data to third countries or international organisations.

Your rights regarding the collection, processing and storage of your personal data

Withdrawal of consent to the processing of your personal data

Article 6. (1) If you do not wish all or part of your personal data to continue to be processed by bluebag.coffee Whether for a specific purpose or for all purposes of processing, you may withdraw your consent to processing at any time by submitting a free-form request.

(2) bluebag.coffee may ask you to verify your identity and confirm that you are the person to whom the data relates.

(3) If you withdraw your consent to the processing of personal data that is required to create and maintain your registration for the use of the services or the purchase of goods, your account will become inactive.

Right of access

Article 7. (1) You have the right to request and receive from bluebag.coffee confirmation as to whether any personal data relating to you is being processed.

(2) You have the right to access the data relating to you, as well as information concerning the collection, processing and storage of your personal data.

(3) bluebag.coffee Upon request, we will provide you with a copy of the personal data relating to you that we process, in electronic or another suitable format.

(4) Access to the data is free of charge, but bluebag.coffee reserves the right to impose an administrative charge in the event of repeated or excessive requests.

Right to rectification or completion

Article 8. You can correct or complete any inaccurate or incomplete personal data relating to you either directly via your profile on the website or by submitting a request to bluebag.coffee

Right to erasure („the right to be forgotten“)

Article 9(1) You have the right to request that bluebag.coffee deletion of your personal data, and bluebag.coffee is obliged to erase them without undue delay where any of the following grounds apply:

• the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
• You withdraw your consent, on which the processing of your data is based, and there is no other legal basis for the processing;
• You object to the processing of your personal data, including for the purposes of direct marketing, and there are no legitimate grounds for the processing that take precedence;
• the personal data was processed unlawfully;
• personal data must be erased in order to comply with a legal obligation under EU law or the law of a Member State applicable to Blue Бag Ltd;
• The personal data was collected in connection with the provision of information society services.

(2) bluebag.coffee is not obliged to erase personal data if it stores and processes such data:

• to exercise the right to freedom of expression and the right to information;
• to comply with a legal obligation which requires processing, provided for in EU law or the law of a Member State to which the Controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller;
• on grounds of public interest relating to public health;
• for the purposes of archiving in the public interest, for scientific or historical research, or for statistical purposes;
• for the establishment, exercise or defence of legal claims.

(3) To exercise your right to be forgotten, you should submit a written request addressed to info@bluebag.coffee, as well as to verify your identity and confirm that you are the person to whom the data relates before bluebag.coffee, by presenting your identity card in person for identification purposes and, if necessary, entering your login details for the data subject’s account in the presence of a member of staff at bluebag.coffee.
– You can delete your profile data and your profile itself here: https://bluebag.coffee/bg/moyat-profil/

(4) bluebag.coffee does not delete data which it is legally obliged to retain, including for the purpose of defending itself against legal claims brought against it or establishing its rights.

Right to restriction

Article 10. You have the right to request that bluebag.coffee to restrict the processing of your personal data where:

• challenge the accuracy of your personal data, for a period that allows eu to verify the accuracy of personal data;
• the processing is unlawful, but you do not wish your personal data to be erased, only for its use to be restricted;
• eu no longer requires the personal data for the purposes of the processing, but you require it for the establishment, exercise or defence of your legal claims;
• You have objected to the processing pending verification of whether the lawful grounds for eu take precedence over your interests.

Right to data portability

Article 11. (1) You can view the data stored and processed about you in connection with your use of the online shop at bluebag.coffee, or request them by email.
You can export your profile data here: My profile | Bluebag.coffee

Changes to the personal data you have submitted to bluebag.coffee You can request it here: My profile | Bluebag.coffee

(2) You can ask bluebag.coffee to transfer your personal data directly to a data controller specified by you, where this is technically feasible.

Right to receive information

Article 12. You can ask bluebag.coffee to inform you of all recipients to whom the personal data, in respect of which a request for rectification, erasure or restriction of processing has been made, has been disclosed. bluebag.coffee may refuse to provide this information if doing so would be impossible or would require a disproportionate amount of effort.

Right to object

Article 13. You may object at any time to the processing of personal data by bluebag.coffee, which relate to you, including where they are processed for the purposes of profiling or direct marketing.

Your rights in the event of a personal data breach

Article 14. (1) If bluebag.coffee If we detect a breach of the security of your personal data which is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay of the breach and of the measures that have been taken or are to be taken.

(2) bluebag.coffee is not obliged to notify you if:

• has taken appropriate technical and organisational measures to protect the data affected by the security breach;
• has subsequently taken measures to ensure that the breach will not result in a high risk to your rights;
• Notification would require a disproportionate amount of effort.

People to whom your personal data is disclosed

Article 15. Econt Express or another logistics company that processes your personal data for the purpose of delivering the goods you have purchased from Blue Bag Ltd.

Article 16. The data controller does not transfer your data to third countries.

Other provisions

Article 17. In the event of a breach of your rights under the above or under the applicable data protection legislation, you have the right to lodge a complaint with the Commission for Personal Data Protection as follows:

1. Name: Commission for Personal Data Protection
2. Registered office and business address: Sofia 1592, 2 Prof. Tsvetan Lazarov Boulevard
3. Correspondence details: Sofia 1592, 2 Prof. Tsvetan Lazarov Boulevard
4. Telephone: 02 915 3 518
5. Email: kzld@government.bg, kzld@cpdp.bg
6. Website: cpdp.bg

Article 18. You may exercise all your rights regarding the protection of your personal data using the forms attached to this notice. Of course, these forms are not mandatory, and you may submit your requests in any form that includes a statement to that effect and identifies you as the data subject.

Article 19. If the consent relates to a transfer, the Controller shall describe the potential risks associated with the transfer of data to third countries in the absence of a decision on adequate protection and appropriate safeguards.

Article 20(1). When you commission bluebag.coffee to process a third party’s personal data for the purposes of purchasing goods/services, Blue Bag Ltd acts as a data processor.

(2). In the cases referred to in paragraph 1, bluebag.coffee acts solely on your instructions as the service user and only to the extent that it can exercise control over the personal data that you process. bluebag.coffee We have no control over the content and data that you, as a user of the service, choose to upload to the service (whether or not such data includes personal data). In this case bluebag.coffee plays no part in the decision-making process as to whether the user utilises the personal data processing service, for what purposes, and whether such data is protected. Accordingly, the responsibility of bluebag.coffee In this case, it is limited to 1) complying with the service user’s instructions in accordance with the contract and the general terms and conditions, and 2) providing information about the goods/services and their functionalities via its interface.

Cookie Policy

The website of bluebag.coffee uses cookies that are essential for the website to function properly. By visiting our website, you consent to the use of cookies.

Legal basis for the collection, processing and storage of your personal data

Types of cookies we use:

• Essential cookies

These cookies are essential for the website to function properly. For example, these cookies enable us to display the information on our website in the correct language and to show prices in the relevant currency and with VAT rates applicable to the respective country. Such cookies also include those used for caching, etc.

• Analytics cookies

Thanks to these cookies, we track traffic to our website and can analyse how easily our users navigate it (Google Analytics cookies). These cookies do not provide us with any information about your personal data. They show us which pages of our website you have viewed, whether you visited our website via a mobile or desktop device, and other anonymous data. For Google Analytics, we also use IP anonymisation via _anonymizelp. The maximum period for which we retain analytical data in Google Analytics is 50 months.

• Functional cookies

These cookies allow you to use the full functionality of our website, watch the videos on it, contact us via the chat function, and save your preferred language for the content displayed on our website.

• Cookies for precise targeting

These cookies contain information about how you have used our website and may be set by our advertising partners. They do not store any personal information. Thanks to them, you will not be shown information that is irrelevant to you. These are dynamic cookies from Facebook, Google, Adform, Adwise and others.

You can check and change the cookie settings on our website here:
Cookie settings

You can manage the cookie settings for our website in the browser you are using.

You can find further information on how to change your cookie settings for the browser you are using in the list below:

• Google Chrome: https://support.google.com/chrome/answer/95647?hl=en
• Firefox https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences
• Internet Explorer: http://windows.microsoft.com/en-GB/windows-vista/Block-or-allow-cookies
• Safari: http://help.apple.com/safari/mac/8.0/#/sfri11471

Please note that if you restrict certain types of cookies, our website may not function correctly and you may not be able to use all of its features.

What security measures have we put in place at bluebag.coffee What about the security of the personal data you store on our infrastructure?

The security of all types of information, including personal data, stored on our infrastructure is a priority for us as a company. Security is something on which we cannot afford to compromise. That is why we have provided information below regarding the security measures our hosting provider implements on its platform and the way in which it protects our email accounts and our communications with you. Our website is hosted on a platform registered in www.superhosting.bg; They, for their part, make the following claim:

“As well as having made every effort to comply fully with the new General Data Protection Regulation, before FIVE Over the years, we have implemented a completely new security system, developed in-house, for our entire infrastructure – SH Protect. It operates on several levels and blocks tens of thousands of attempts every day to compromise client websites and client information, including personal data.
Every day, we add new rules to it and ensure that our customers’ information is protected to the highest standard.
Also before FIVE Over the years, we have implemented a comprehensive DDoS protection system. The DDoS protection system detects 95% of known types of DDoS attacks and is constantly updated to include newly identified attacks.
“Through all these measures, we have blocked – and continue to block – hundreds of thousands of attempts each year to carry out malicious acts against the information that our customers store on our servers.”

You can find out more about how we protect your data in your web projects and email accounts on our blog:
https://blog.superhosting.bg/security-challenge-accepted.html