Doprava zdarma od 3 lahviček

Privacy Policy

Section I — General Information

As of 25 May 2018, a new data protection regulation adopted by the European Union — the General Data Protection Regulation or GDPR for short — came into force. The main purpose of the regulation is to ensure the protection of the data of individuals from all EU member states and to unify the regulations of their processing. As a personal data Administrator, NETWORK LOGIC Ltd. has taken all organizational and technical protection measures to be able to meet all the requirements of the new regulation by collecting individuals' data only to fulfil the donation contract and/or send a newsletter with information about new services, special news offers, etc.

Art. 1. (1) Data concerning the data Administrator, as well as information under the E-commerce Act and the Consumer Protection Act:

  • Name: NETWORK LOGIC Ltd
  • UIC/BULSTAT: 201139421
  • Headquarters and registered office: Sofia, Vitosha district, Blvd. 425, Tsar Boris III Street
  • Address for correspondence: Sofia, Vitosha district, 425, Tsar Boris III Street
  • Email: contact@herbawave.com

(2) Control bodies in connection with the activities of the Administrator:

  • Name: Personal Data Protection Commission
  • Headquarters and registered office: 1592, Sofia Blvd. "Prof. Tsvetan Lazarov" No. 2
  • Phone: 02 915 3 518
  • Email: kzld@cpdp.bg

(3) The Administrator carries out its activities following the Personal Data Protection Act and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons about the processing of personal data and the free movement of such data.

Section II — Basis for Collecting, Processing, and Storing Your Data

Art. 2. (1) The Administrator collects and processes your data in connection with the use of the web-based platform available at https://herbawave.com to conclude a reward donation contract based on Art. 6 para. 1, Regulation (EU) 2016/679 (GDPR), and in particular on the following grounds:

  • Your explicit consent as a User;
  • Conclusion and performance of our obligations under the distance purchase contract;
  • Performance of the Administrator's obligations under a contract with you;
  • Compliance with a legal obligation applicable to the Administrator;
  • For the legitimate interests of the Administrator.

Section III — Purposes and Principles for the Collection, Processing and Storage of Your Data

Art. 3. (1) The trader collects, processes and stores personal data that you provide in connection with the use of the online shop, the conclusion of a distance purchase contract, namely in the following hypotheses:

  • When sending an email newsletter with information about new products, special offers, promotional campaigns and discount codes, subject to your prior consent and the indication of your email address in the relevant subscription field;
  • Sending a response to a request made to the Merchant via the online store interface or by email;
  • Conclusion and execution of a distance purchase contract, including about delivery, concluded with the Merchant via the online shop interface;
  • Statistical and marketing needs to optimize the user experience, improve functionalities and design using cookies.

(2) In processing your data, we comply with the following principles:

  • Lawfulness, fairness, and transparency;
  • Limitation of the purposes of the processing;
  • Data minimization following the purposes;
  • Limitation of storage to achieve the purposes;
  • Data accuracy and timeliness;
  • Integrity and confidentiality of processing and ensuring its security.

(3) In processing and storing personal data, the Administrator may process and store personal data to protect its legitimate interests, such as the protection of a legal interest before the competent Bulgarian court, the performance of its obligations to the National Revenue Agency (NRA), the Ministry of the Interior (MIA) and other state and municipal authorities.

Section IV — What Types of Personal Data Does the Administrator Collect, Process, and Store?

Art. 4. (1) The Administrator shall carry out the following operations with the personal data provided by you for the following purposes:

Your data (name, surname, telephone, email, address, etc.)

Purposes for which the data is collected:

  • Providing feedback to the User about responding to their requests;
  • Registration of an account in the online store;
  • Execution of a distance purchase contract for the goods requested.

Grounds for processing: By accepting the terms and conditions and registering in the online store or placing an order through the "Order as a guest" option, a contractual relationship is established between the Merchant and the User, on which basis personal data is processed — Art. 1 (b) GDPR.

Delivery data (names, telephone, address, etc.)

Purpose: Fulfilment of the Merchant's obligation to deliver the ordered goods by transmitting the data to a third-party freight forwarder.

Grounds for processing: Upon acceptance of the General Terms and Conditions and the Privacy Policy, at the time of concluding the contract, a contractual relationship is created based on which we process your data — Art. 6, para. 1 (b) GDPR.

Bank transaction data (debit/credit card number, CVV, geolocation, IP address)

Purpose: The data is collected to make a banking transaction (money transfer) from a user's account to a contractor's account to enter into a reward donation contract.

Grounds for processing: By accepting the terms and conditions and the privacy policy of the platform, a contractual relationship is established — Art. 1 (b) GDPR. Your data for sending the newsletter as well as for sending a message via the contact form are processed based on your explicit consent — Art. 6 para. 1 (a) GDPR.

User experience data (orders, products ordered, visit frequency, time spent, products viewed)

Purpose: Optimization of the content and design of individual pages, to personalize conditions for selling goods remotely, to increase customer satisfaction, and overall improvement of services. The information is anonymized and encrypted.

We may use cookies, web beacons, tracking pixels, and other tracking technologies on the Site to improve your experience. You can reject or remove cookies.

Grounds for processing: Upon acceptance of the General Terms and Conditions, the Privacy Policy or consent to the use of cookies — Art. 6 para. 1 (a) GDPR.

Section V — Retention Period of Your Data

Art. 7. (1) The trader shall keep your data only for the period necessary to achieve the purposes set out in this Policy, and where entitled or obliged by law to keep it for a longer period.

(2) The time limits we observe are as follows:

  • Individually identifiable personal data — up to 5 years;
  • Delivery data — up to 5 years;
  • User experience data — up to 2 years from the last visit to the website.

Art. 8. The Administrator shall store the personal data of the legal representatives of its business partners for the duration of the performance of the contract.

Section VI — Transfer of Your Data for Processing

Art. 9. (1) The Administrator may transfer some or all of your data to processors for the fulfilment of the processing purposes, subject to the requirements of Regulation (EU) 2016/679 (GDPR).

(2) The Administrator shall not transfer your data to third countries or international organizations unless you have been expressly informed.

(3) Your data is only stored on the territory of the European Union. If transferred to a third party outside the EU, you will be explicitly notified before the transfer.

(4) Your banking transaction data is stored and processed solely by our payment processor. The Administrator does not store financial data. We encourage you to review the payment processor's privacy policy.

Section VII — Your Rights in the Collection, Processing, and Storage of Your Data

Art. 10. (1) You may withdraw your consent to the processing at any time.

(4) You may withdraw your consent to the processing of your data for direct marketing purposes at any time.

(5) The withdrawal of consent does not affect the lawfulness of the processing carried out prior to that point.

Right of Access

Art. 11. You have the right to request and obtain confirmation of whether personal data relating to you are being processed. You have the right to access the data and related information. The Administrator shall provide a copy of the data upon request. Providing access to the data is free of charge, but the Administrator reserves the right to charge an administrative fee for repetitive or excessive requests.

Right to Rectification or Completion

Art. 12. You may rectify or complete inaccurate or incomplete personal data relating to you directly through your account on the website.

Right to Erasure ("Being Forgotten")

Art. 13. (1) You have the right to ask the Data Administrator to erase personal data relating to you where:

  • The personal data is no longer necessary for the purposes for which it was collected;
  • You withdraw your consent and there is no other legal basis for processing;
  • You object to the processing and there are no overriding lawful grounds;
  • The personal data has been unlawfully processed;
  • The personal data must be erased to comply with a legal obligation;
  • The personal data was collected in connection with information society services.

(2) The Administrator is not obliged to erase the data if it stores and processes them for the exercise of the right to freedom of expression, to comply with a legal obligation, or for the establishment, exercise, or defence of legal claims.

Right to Restriction

Art. 14. You have the right to require the Administrator to restrict the processing of data where you contest accuracy, the processing is unlawful but you do not wish erasure, or you have objected to processing pending verification.

Right to Portability

Art. 15. If you have given consent to processing or it is necessary for contract performance, you may request your data in a readable format and transfer it to another Administrator, or ask the Administrator to transfer it directly where technically feasible.

Right to Receive Information

Art. 16. You may request the Administrator to inform you of all recipients to whom data for which rectification, erasure, or restriction has been requested has been disclosed.

Right to Object

Art. 17. You may object at any time to the processing of personal data, including for profiling or direct marketing purposes.

Your Rights in the Event of a Personal Data Breach

Art. 18. (1) If the Administrator becomes aware of a breach that may pose a high risk to your rights, it shall notify you without undue delay of the breach and the measures taken.

Section VIII — Persons Who Have Access to Your Data

Art. 19. (1) The Administrator may provide your data to the following processors:

  • Employees of NETWORK LOGIC Ltd responsible for processing requests;
  • Employees in the accounting and legal department;
  • Hosting service provider & technical department.

Purposes: processing of data for account registration, accounting records, provision of information society services, and protection of the Administrator's legitimate interests.

Art. 20. The Administrator shall not transfer your data to third countries unless you expressly agree. Data is stored and processed throughout the EU and the EEA. Transfers outside are subject to binding corporate rules, standard contractual terms, or approved certification mechanisms.

Section IX — Annexes

Art. 21. (1) You can exercise all your rights regarding data protection through the forms attached below or through your profile functionalities:

  • Withdrawal of consent form for processing purposes — Annex 1
  • Request "to be forgotten" — to delete personal data — Annex 2
  • Request for the portability of personal data — Annex 3
  • Request for rectification of data — Annex 4

(2) These forms are optional and you may make your requests in any form that contains a statement to that effect and identifies you as the data holder.

This privacy policy is accepted and effective as of 01.06.2024.