Policy for personal data protection

POLICY FOR PERSONAL DATA PROTECTION OF SMART-BOX.BG OOD,

And CONFIDENTIALITY POLICY. COOKIES.

SMART-BOX.BG OOD (hereinafter referred to as Controller of the Company) performs its activity in compliance with the Law on Personal Data Protection and Regulation (EU) 2016/679 of the European Parliament and of the Council of 01 October 2015 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. This information aims to inform you about all aspects of processing your personal data by the Company and the rights you have in reference with this processing.

1. Terms:

• „personal data“– each information that refers to a natural person (data subject) and through which the latter can be identified according to the meaning of Regulation (EU) 2016/679 (hereinafter referred to as Regulation); 
• „identifiable natural person“ – a person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
• „data subject“ – each natural person Use of the mobile application SmartBox and visitor of the site www.smart-box.bg;
• „personal data processing (Processing)“ - any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction; 
• „profiling“ - any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements; 
• „pseudonymisation“ - the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person; 
• „Electronic statement“ according to the meaning of the Law on Electronic Document and Electronic Certification Services - verbal statement presented in digital form by a generally adopted standard of transformation, reading and visual presentation of the information;
• „electronic document“ according to the meaning of Regulation (EU) No910/2014  - any content stored in electronic form, in particular text or sound, visual or audiovisual recording;
• The cookies (cookies) – small text files that are stored by the website and mobile application through Internet server on the hard disk for each User and enable to retrieve information about User by identifying them before the relevant system. 

2. Main provisions

• In its activity of personal data processing, SMART-BOX.BG OOD shall observe the principles of conformity with the law, good faith and transparency, minimization of the collected data, accuracy in the timely erasure or correction of inaccurate personal data, limitation of contents.
• The Company shall collect personal data about particular, explicitly specified and legitimate purposes and not process the collected personal data further in a manner not consistent with those purposes.
• The Company shall store personal data in a form which allows the identification of the data subject for a period no longer that what is necessary for the purposes for which personal data are processed.
• The Company shall process the personal data in a manner ensuring a suitable level of security, including protection against unauthorized or illegal processing or against an occasional loss, destruction or damage, and suitable technical or organizational measures are to be applied („comprehensiveness and confidentiality“).

3. The Company shall take the due care and be responsible for the protection of the information the User pursuant to the existing national and European legislation that became known to them due to the use of the services and/or the use/visiting of the mobile application SmartBox – subject-matter of the General Terms for the Users and the incorporated Personal Data Protection Policy (hereinafter referred to as Policy).

4. The following personal data are provided for the registration of a User in the mobile application SmartBox: Name and surname; e-mail account; year of birth; telephone; city; gender. In addition, information about the performing of the registration and consent with these General Terms and the Personal Data Protection Policy (date, time, type of browser (web or mobile) and IP address) is stored.

5. Aiming to examine and resolve the received complaints, inquiries or other questions and correspondence sent in the communication to the mobile application SmartBox, received through e-mail, the Company shall store and process this information and the result of this processing.

6. The Company may also process other data related to the User, in the cases where the latter provides voluntarily such data by filling in the relevant electronic forms in the mobile application, adding preferences, settings, etc.

7. Each User shall provide personal data for the purposes of registration in SmartBox and using the functionality of the mobile application SmartBox; maintenance and administration of the mobile application SmartBox and the functionalities provided through it; detection and correction of technical problems; detecting and avoiding malicious acts; establishing communication; receipt, processing and exchange of electronic written documents, notices, complaints and others between the User and the Company.

8. The Company shall not collect or process personal data that refer to the following: 

• They disclose racial or ethnic origin;
• They disclose political, religious or philosophic believes, or membership in trade-union organizations;
• Genetic or biometric data, data about the health status or data about the sexual life or sexual orientation;
• Data about persons below 18 years of age, except with the explicit consent of their parents or legal representatives;

9. Grounds for processing your personal data – with the acceptance of the General Terms and registration in SmartBox, or with concluding of a written agreement between the Company and you, contractual relations are established based on which, we process your data – art. 6, para. 1, letter (b) GDPR;

10. The Company shall observe the following principles in the processing of your personal data:

• Conformity with the law, good faith and transparency; 
• Limiting the purposes of the processing;
• Relevance with the purposes of the processing and minimizing the data collection;
• Accuracy and actuality of the data;
• Limiting the storage in view of achieving the goals;
• Entirety and confidentiality of the processing and ensuring a suitable level of personal data security;

11. The Company shall store and use log files with the following purposes:

• For creating a profile and providing full functionality in the use of the services provided by the Company;
• For placing orders for use of the services of the Company;
• For individualization of a party to the agreement;
• For accounting and statistic purposes;
• For protection of the information security;
• For securing the execution of the agreement for providing the relevant service;
• For participation in conducting games, lotteries, advertising campaigns;
• For sending an information bulletin upon a desire expressed by you;
• To ensure the reliable functioning of the mobile application SmartBox, identifying technical problems, attempts for malicious actions;
• To keep statistics and measuring the number of daily/monthly/annual visits and usability;
• For the use the mobile application SmartBox by User through their profile (date and time of using the profile, type of browser);
• For other statutory purposes;

 

12. The Company shall collect, use and process the information specified above for the purposes envisaged in the General Terms for use of the mobile application SmartBox by the Users and the Policy for Data Protection, an inseparable part of them, that may be: 

• Objectives necessary for the use of the services provided by SmartBox – registration of a user, for use of portable batteries for mobile devices (Power Bank).
• Objectives for which the User gave their explicit consent; 
• Objectives necessary for the execution of the statutory obligations of the Company.

 

13. Each User shall provide personal data aiming to use the services provided by SmartBox, including the processing of the provided personal data in case of necessity of a subsequent legitimation.

14. Each User shall provide personal data aiming to exercise the rights and legal interests of the Company, including under judicial procedure; in reference to the protection of personal data of the User, in reference to the providing of the personal data stored and processed by the Company upon a request by competent and control governmental and administrative authorities, including by judicial bodies. 

15. The Company shall be obliged to notify each User when their processes personal data are provided pursuant to the existing legislation.

16. The Company shall process the personal data provided by the User after the explicit consent thereof has been obtained, on legal grounds and/or legitimate interest.

17. The Company shall store your personal data for a term not longer than the existence of your profile in SmartBox or until the withdrawal of the consent for processing. After the deleting of your profile or the successful completion, the Company shall take the due care to erase and eliminate all your data, without any undue delay, or to anonymize them (i.e., to make them in a form not disclosing your identity).

18. The Company shall store your personal data provided in reference to online placed offers for a period of 5 years for the purposes of protection of the legal interests of the Company in judicial or administrative disputes with users of the mobile application, and the accounting documents shall be stored for the relevant statutory period. 

19. The Company shall notify you in case the term for storage of data may be extended in view of execution of a legal obligation or in view of legitimate interests of the Controller or another.

20. The Company shall store the personal data of the legal representative of its commercial partners for the term of validity of the agreement for observance of the legitimate interests and the legal obligations of the Controller, and this term may exceed the term of the concluded agreement.

21. The term for storage of data shall continue pro rata until the final completion of the arisen dispute or proceeding before all instances in case of arisen legal dispute or proceedings requiring data protection and/or a request from a competent governmental authority. In case of changes in the applicable law – the terms for storage shall be extended and/or reduced respectively to the changes.

22. Withdrawal of the consent for processing your personal data:

• If you do not wish all or part of your personal data to continue to be processed by the Company for a particular or for all purposes of processing, you may at any time withdraw your consent with the processing by filling in the form of your profile or by a narrative request.
• The Controller may request that you certify your personal identity and the identity with the person the data refer to by requesting you to insert e-mail account and password for access to the site on the spot at the office of the Company before an employee of ours.
• With the withdrawing of the consent with the processing of personal data that are mandatory for creating and maintaining a profile in SmartBox, your account will become inactive. Of course, you will be able to review the site and the offered services, and to make a new registration.
• If there is a request placed by you to use the services that is in the course of processing, the earliest time at which you can withdraw your consent with the processing is at the successful completion of the service.

23. Right of access:

• You have the right to request and receive from the Controller a confirmation as to whether to process personal data related to you if you are a registered user, you may at any time see in your profile the personal data that you provided and are processed about you.
• You have the right to receive access to the data related to you and to the information related to the collection, processing and storage of your personal data.
• The Controller shall provide you, upon request, with a copy of the processed personal data related to you, in electronic or other suitable form.
• The providing of access to the data is free of charge but the Controller shall preserve the right to impose an administrative charge in case of repetition or excessive scope of requests. 

 

24. Rights of correction or addition: you may correct or add incorrect or incomplete personal data related to you directly through your profile in the website or by sending a request to the Controller.

 

25. Right of erasure („to be forgotten“): 

25.1. You have the right to request from the Controller the erasure of part or all personal data related to you and the Controller shall have the obligation to erase them without any undue delay where there is any of the below specified grounds:

• The personal data are no longer necessary for the purposes for which they were collected or processed in another manner;
• You withdraw your consent on which the data processing is based and there are no other legal grounds for the processing;
• You object against the processing of the personal data related to you, including for the purposes of direct marketing, and there are no legal grounds for the processing that take precedence;
• The personal data have been processed illegally;
• The personal data should be erased aiming to observe a legal obligation pursuant to the law of EU or the right of a member state that is applied to the Controller;
• The personal data have become in the public domain.

 

25.2. The Controller shall not be obliged to erase the personal data if they store and process them: 

• To exercise the right of freedom of expression and information;
• To observe the legal obligation that requires processing envisaged in the law of EU or the right of a member state that is applied to the Controller or for execution of a task of public interest, or in exercising official authorities granted to them;
• Due to reasons of public interest in the field of public health;
• For the purposes of archiving to public benefit, for scientific or historical research or for statistical purposes;
• To ascertain, exercise or protect legal claims;

 

25.3. In case you exercise your right to be forgotten, the Company will erase all your data, with the exception of the following information:

• Information that is necessary to certify that your right to be forgotten has been fulfilled;
• Technical information about the functioning of SmartBox which information cannot be related in any way with your person;
• E-mail with which, you have performed registration at SmartBox;

25.4. To exercise your right to be forgotten, it is necessary that you submit through your profile in SmartBox or by sending a request to the Controller by e-mail.

25.5. The Controller may request that you prove your personal identity and identity with the person the data are about. 

25.6. If there is an order placed by you for the service that is in a course of processing, the earliest time at which you can request to be “forgotten” is at the successful completion of the order.

25.7. With the erasure of your personal data, your account will become inactive Of course, you can review SmartBox and the offered products and place orders as a guest, or make a new registration.

25.8 The Controller shall not erase the date they are legally obliged to store, including to protect in reference to judicial claims brought against them, or for proving their rights.

 

26. Right of limitation: You have the right to request from the Controller to limit the processing of data related to you if:

• You dispute the accuracy of the personal data for a term allowing the Controller to check the accuracy of the personal data;
• the processing is irregular but you do not wish that the personal data are erased but only that their use is limited;
• the Controlled does not need any longer the personal data for the purposes of the processing but you require them for establishing, exercising or protection of your legal claims;
• you have objected against the processing in expectation of a check as to whether the legal grounds of the Controller prevail your interests. 

 

27. Right of transferability:

• You can download at any time or receive in a documented form the data that are stored and processed about you using the services of the Controller, directly through your profile through the option for data export or by an e-mail request.
• You can request from the Controller directly to transfer your personal data to a data controller specified by you where this is technically feasible.

 

28. Right to receive information: You can request from the Controller to inform you about all recipients to whom the personal data for which correction, erasure or limiting the processing have been requested were disclosed. The Controller may refuse to provide this information if this would be impossible or would require disproportionately great efforts.

 

29. Rights of remuneration: you may object at any time against the processing of personal data by the Controller that are related to them, including if they are processed for the purposes of profiling or direct marketing.

 

30. Your rights in case of violation of the safety of your personal data: 

30.1. If the Controller finds a violation of the security of your personal data which may give rise to a high risk for your rights and freedoms, they shall notify without undue delay about the violation and about the measures that were undertaken or is pending to be undertaken.

30.2. The Controller shall not be obliged to notify you if: 

• They have undertaken suitable technical and organizational measures for protection of the data affected by a violation of security; 
• They have undertaken subsequently measures that guarantee that the violation will not result in a high risk for your rights;
• The notification would require disproportionate efforts.

 

31. Policy for cookies:

 

30.1. Use of cookies:

Cookies are short text files or small packs of information that are stored through the Internet browser on your end device (computer, tablet, laptop or mobile phone) when you visit various sites and pages in Internet. The main purpose of cookies is to make the user recognizable when they return to the website again. Some cookies have a more specific application such as, for example, to memorize the user behaviour on the site and to facilitate the user during the use of the website.

 

30.2. How are cookies used on this website?

We use cookies on this website mainly aiming to facilitate the usability of this website, improvement of its functioning and storage of information about the user behaviour. In this process, no personal data are stored, i.e., we cannot identify you as a person through the cookies on the Company site, therefore, the data protection legislation is not applied for the collecting of this information. The information collected from cookies is usually used in a summarized form aiming to analyse the user behaviour on the website that allows us to improve the functionality of the site, the user paths and the used contents.

 

30.3. What cookies are used on this website? 

• Serial cookies:  This type of cookies facilitates you in the use of the site and they store information temporarily, only within the session of the used browser. Usually the information stored through them is what products you added in the card of the online shop, which pages of the site you visited and how you reached given information. These cookies do not collect information from your end device and are erased automatically when you leave the website or terminate the session of your browser.
• Permanent cookies: They enable us to store particular information about browsing, for example, to analyse the visits to the site, how you reached the site, what pages you reviewed, what options you selected and where you headed through this website. The tracing of this information enables us to make improvements to the website, including to correct errors and to expand the contents. The term of storage of this type of cookies varies according to their particular purpose.
• Cookies of third parties:  On our website, there are links to other sites or imbedded contents of other sites, for example from Facebook, YouTube, Twitter, Google+, LinkedIn, websites of partners of the Company. It is possible when you visit these sites or open the contents in them, that cookies from these sites are stored on your end device. It is exactly these cookies that are defined as cookies of third parties and the Company has no control on the generation and management of those cookies. That’s why, we recommend that you search for information about them and the way they are managed on the websites of the relevant third parties.

30.4. How can I manage the use of cookies by this website? All browsers allow the management of cookies from a folder on your browser specially created for the purpose. You may block the receiving of cookies, erase all or part of them or fix your settings for preferences regarding the use of cookies before you initiate a visit to www.smart-box.bg. Have in mind that the erasing or blocking of cookies may affect unfavourably the function of your website and thence, your actions in it. 

30.5. Turning off or blocking of cookies: The controlling, turning off or blocking of cookies is managed from the settings of your browser. Have in mind that the full banning of the use of all cookies may reflect on the functional performance of the site, its efficiency and the access to certain information. All cookies used on this website are eliminated/erased automatically after a certain period of time. This period is different depending on the purpose of the particular cookie. 

31. The Company does not use technologies that process personal data so that the data subject (natural person User) is subject of a solution based only on automatic processing, including profiling which causes legal consequences for the data subject or affects them to a significant extent except if there are the grounds envisaged in the applicable legislation for protection of rights, freedoms and legitimate interests of the data subject.

32. The Company shall not be responsible for accuracy of the data provided by the User, does not perform any checks in this regard and does not guarantee the actual identity of the natural persons who provided the data. In all cases of doubt, of ascertained fraud and/or misuse, the User should notify the Company immediately.

33. Each user may specify their questions and requests related to exercising their rights related to protection of personal data to the Controller at the address of the registered address of the Company or to e-mail: info@smart-box.bg. 

34. Actuality and change of the rules. Aiming to apply the most actual measures for protection and aiming to observe the existing legislation, we will regularly update these Rules through our internet site. We kindly ask you to review regularly the current version of those rules, to be permanently informed about how we take care of the protection of the personal data we collect.

 

In case a User does not agree with the General Terms and with the Personal Data Protection Policy, the Company denies to provide access to the services offered by SmartBox and to be party to legal relations with the relevant User.