Privacy Policy

This is an English translation of the Bulgarian text, given for convenience. In case of any difference, the Bulgarian text prevails.

DZHYMOTO.BG EOOD (hereinafter referred to for brevity as the “Controller” or “the Company”) conducts its activities in accordance with the Personal Data Protection Act and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. This information is intended to inform you about all aspects of the processing of your personal data by the Company and the rights you have in connection with this processing.

Grounds for the collection, processing and storage of your personal data

Art. 1. The Controller collects and processes your personal data in connection with the use of the online shop www.gxtmoto.store and the conclusion of contracts with the company pursuant to Art. 6, para. 1, Regulation (EU) 2016/679 (GDPR), and specifically on the basis of the following grounds:

Explicitly received consent from you as a customer;
Performance of the Controller’s obligations under a contract with you;
Compliance with a legal obligation that applies to the Controller;
For the purposes of the legitimate interests of the Controller or of a third party;

Purposes and principles in the collection, processing and storage of your personal data

Art. 2. (1) We collect and process the personal data that you provide to us in connection with the use of the online shop www.gxtmoto.store and the conclusion of a contract with the company, including for the following purposes:

creation of a profile and provision of full functionality when using the online shop;
identification of a party to the contract;
accounting purposes;
statistical purposes;
protection of information security;
ensuring the performance of the contract for the provision of the respective service;
sending a newsletter and emails with special offers upon your expressed request;

(2) We adhere to the following principles when processing your personal data:

lawfulness, fairness and transparency;
purpose limitation;
relevance to the purposes of the processing and data minimisation;
accuracy and timeliness of data;
storage limitation in order to achieve the purposes;
integrity and confidentiality of processing and ensuring an appropriate level of personal data security.

(3) When processing and storing personal data, the Controller may process and store personal data in order to protect its following legitimate interests:

fulfilment of its obligations to the National Revenue Agency, the Ministry of Interior and other state and municipal authorities.

What types of personal data our company collects, processes and stores

Art. 3. (1) The Company carries out the following operations with the personal data provided by you as customers, for the following purposes:

Registration of a customer in the online shop and performance of a distance sales contract – the purpose of this operation is the creation of a profile for using the online shop to purchase goods and providing contact details for delivering the purchased goods. Registration and the creation of a profile to use the online shop is not a mandatory step for the provision of the service and it is largely accessible without creating a profile via the “Order as guest” option. It is considered that the operation “Registration of a user in the online shop and performance of a distance sales contract” is permissible to carry out and provides sufficient safeguards for protecting the rights and legitimate interests of the data subjects in accordance with GDPR requirements;
Sending a newsletter – the purpose of this operation is administering the process of sending newsletters, emails with special offers, promotions, promo codes, news and new features to customers who have requested to receive them.
Exercising the right of withdrawal or filing a complaint – the purpose of this operation is administering the process of exercising the right of withdrawal or filing a complaint by the customer regarding goods in respect of which these rights may be exercised.

(2) The Controller does not collect or process personal data that relate to the following:

reveal racial or ethnic origin;
reveal political, religious or philosophical beliefs, or trade union membership;
genetic and biometric data, health data or data concerning sex life or sexual orientation.

(3) The personal data are collected by the Controller from the individuals to whom they relate.

(4) The Controller does not carry out automated decision-making with data.

(5) The Company does not collect data on persons under 16 years of age, except with the express consent of their parent or legal representative.

Art. 4. (1) The Controller processes the following categories of personal data and information for the following purposes and on the following grounds:

Your identifying details (email address, name, etc.)
Purpose for which data are collected: 1) Contacting the user and sending information to them, 2) for the purposes of user registration in the online shop, as well as 3) for sending a newsletter, emails with special offers, promotions, promo codes, news and new features.
Legal basis for processing your personal data – By accepting the general terms and conditions and registering in the online shop, or placing an order without registration, or upon concluding a written contract, a contractual relationship is established between the Controller and you, on which basis we process your personal data – Art. 6, para. 1, letter (b) GDPR. Your data for sending a newsletter and emails are processed based on your express consent – Art. 6, para. 1, letter (a) GDPR.
Data for delivery (names, telephone, address, etc.)
Purpose for which data are collected: Performance of the Controller’s obligations under a sales contract and delivery of the purchased goods.
Legal basis for processing your personal data – By accepting the general terms and conditions and registering in the online shop, or placing an order without registration, or upon concluding a written contract, a contractual relationship is established between the Controller and you, on which basis we process your personal data – Art. 6, para. 1, letter (b) GDPR.
Purpose for which data are collected: 1) Contacting the user and sending information to them and 2) for the purposes of user registration in the online shop.
Legal basis for processing your personal data – By accepting the general terms and conditions and registering in the online shop via a social network profile, a contractual relationship is established between the Controller and you, on which basis we process your personal data – Art. 6, para. 1, letter (b) GDPR.
Data from your social network profiles (publicly available information from your profiles on Google+, Facebook)

Storage period of your personal data

Art. 5. (1) The Controller stores your personal data for a period no longer than the existence of your profile in the online shop or the completion of an order “as a guest”. Following the deletion of your profile or the completion of the order, the Controller takes reasonable care to erase and destroy all your data without undue delay or to anonymise them (i.e. to convert them into a form that does not reveal your identity).

(2) The Controller stores your personal data provided in connection with online orders placed for a period of 5 years for the purposes of defending the legal interests of the Controller in judicial or administrative disputes with users of the online shop, with accounting documents being stored for the respective statutory period.

(3) The Controller notifies you in the event that the data storage period needs to be extended in view of compliance with a statutory obligation or in view of legitimate interests of the Controller or otherwise.

(4) The Controller stores personal data that it is required to retain under applicable legislation for the relevant designated period, which may exceed the period of existence of your profile in the online shop or until completion of the order.

Art. 6. (1) The Controller stores the personal data of the legal representatives of its commercial partners for the period of performance of the contract, to comply with the legitimate interests and statutory obligations of the Controller, and this period may exceed the term of the concluded contract.

Transfer of your personal data for processing

Art. 7. (1) The Controller may, at its own discretion, transfer part or all of your personal data to data processors for the performance of the processing purposes to which you have consented, subject to compliance with the requirements of Regulation (EU) 2016/679 (GDPR).

(2) The Controller notifies you in case of intention to transfer part or all of your personal data to third countries or international organisations.

Your rights in the collection, processing and storage of your personal data

Withdrawal of consent to the processing of your personal data

Art. 8. (1) If you do not wish all or part of your personal data to continue to be processed by the Company for a specific purpose or for all processing purposes, you may withdraw your consent to processing at any time by filling out the “Consent Withdrawal Form for Processing Purposes” or by a free-text request.

(2) The Controller may require you to verify your identity and identity with the person to whom the data relate.

(3) By withdrawing consent to the processing of personal data that are mandatory for creating and maintaining a profile in the online shop, your account will become inactive. Of course, you will be able to browse the online shop and offered products and place orders as a guest or create a new registration.

(4) If there is an order placed by you that is in the process of being processed, the earliest point at which you can withdraw your consent to processing is upon the successful completion of the order.

(5) You may at any time withdraw your consent to the processing of your personal data for direct marketing purposes.

(6) The withdrawal of consent does not affect the lawfulness of processing of personal data that the Controller has carried out up to that point.

Right of access

Art. 9. (1) You have the right to request and obtain confirmation from the Controller as to whether personal data relating to you are being processed, and you may at any time view in your profile, if you are a registered user, the data we process for you.

(2) You have the right to obtain access to the data relating to you, as well as to information concerning the collection, processing and storage of your personal data.

(3) The Controller provides you upon request with a copy of the processed personal data relating to you, in electronic or other suitable form.

(4) Providing access to the data is free of charge, but the Controller reserves the right to impose an administrative fee in the event of repetitive or excessive requests.

Right to rectification or completion

Art. 10. You may rectify or complete inaccurate or incomplete personal data relating to you directly through your profile on the website or by submitting a request to the Controller.

Right to erasure (“to be forgotten”)

Art. 11. (1) You have the right to request from the Controller the erasure of part or all of the personal data relating to you, and the Controller has the obligation to erase them without undue delay where one of the grounds specified below applies:

the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
you withdraw your consent on which the processing of the data is based and there is no other legal ground for the processing;
you object to the processing of personal data relating to you, including for direct marketing purposes, and there are no overriding legitimate grounds for the processing;
the personal data have been unlawfully processed;
the personal data have to be erased for compliance with a legal obligation in EU law or the law of a Member State that applies to the Controller;
the personal data have been collected in relation to the offer of information society services.

(2) The Controller is not obliged to erase the personal data if it stores and processes them:

for exercising the right of freedom of expression and information;
for compliance with a legal obligation which requires processing provided for by EU law or the law of the Member State that applies to the Controller or for the performance of a task carried out in the public interest or in the exercise of official authority vested in it;
for reasons of public interest in the area of public health;
for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes;
for the establishment, exercise or defence of legal claims.

(3) In the event of exercising your right to be forgotten, the Company will erase all your data, with the exception of the following information:

information that is necessary to verify that your right to be forgotten has been fulfilled – email, IP address;
technical information regarding the functioning of the online shop, which cannot be linked in any way to your person;
email address with which you registered in the online shop.

(4) In order to exercise your right to be forgotten, it is necessary to take the following steps:

Submit an application by sending a completed “Request to be Forgotten”;
Authenticate yourself as the account holder;

(5) Once we have authenticated the identity of the person making the request and the person to whom the data relate in accordance with the steps set out above, we will erase all data that we process about you, in accordance with para. 3.

(6) If you have placed an order that is in the process of being processed, the earliest point at which you can request to be “forgotten” is upon the successful completion of the order.

(7) Upon erasure of your personal data, your account will become inactive. Of course, you will be able to browse the online shop and offered products and place orders as a guest or create a new registration.

(8) The Controller does not erase data that it has a legal obligation to store, including for defence in connection with legal claims brought against it or to establish its rights.

Right to restriction

Art. 12. You have the right to request the Controller to restrict the processing of data relating to you where:

you contest the accuracy of the personal data, for a period enabling the Controller to verify the accuracy of the personal data;
the processing is unlawful, but you do not want the personal data erased, but only their use restricted;
the Controller no longer needs the personal data for the purposes of the processing, but you require them for the establishment, exercise or defence of legal claims;
you have objected to processing pending verification whether the legitimate grounds of the Controller override your interests.

(2) In the event of exercising your right to restriction, the Company will suspend the processing of your data, but will not remove the data you entered in the online shop.

Right to data portability

Art. 13. (1) If you have given consent for the processing of your personal data or the processing is necessary for the performance of the contract with the Controller, or if your data are processed by automated means, you may, after authenticating yourself before the Controller:

request the Controller to provide you with your personal data in a readable format and transmit them to another Controller;
request the Controller to transmit your personal data directly to a controller designated by you, where technically feasible.

(2) You may at any time download or receive in a machine-readable format the data that are stored and processed about you in connection with using the Controller’s services upon request by email.

Right to receive information

Art. 14. You may request the Controller to inform you regarding all recipients to whom personal data for which rectification, erasure or restriction of processing has been requested have been disclosed. The Controller may refuse to provide this information if this proves impossible or involves disproportionate effort.

Right to object

Art. 15. You may object at any time to the processing of personal data by the Controller relating to you, including where processed for profiling or direct marketing purposes.

Your rights in the event of a personal data breach

Art. 16. (1) If the Controller identifies a breach of security of your personal data that may result in a high risk to your rights and freedoms, it shall notify you without undue delay of the breach, as well as of the measures that have been taken or are to be taken.

(2) The Controller is not obliged to notify you if:

it has implemented appropriate technical and organisational protection measures in respect of the data affected by the security breach;
it has subsequently taken measures ensuring that the breach is no longer likely to result in a high risk to your rights;
the notification would involve disproportionate effort.

Recipients to whom your personal data are provided

Art. 17. For the purposes of processing your personal data and providing the service in its full functionality and in view of your interests, the Controller may provide your data to the following data processors:

Data processor	Purpose of personal data processing
Supplier / Courier company	Performing delivery to an address

The specified data processors comply with all requirements for lawfulness and security in the processing and storage of your personal data.

Art. 18. The Controller does not transfer your data to third countries.

Art. 19. In the event of a breach of your rights pursuant to the above or applicable personal data protection legislation, you have the right to lodge a complaint with the Commission for Personal Data Protection, as follows:

Name	Commission for Personal Data Protection
Registered office and address of management	1592 Sofia, 2 Prof. Tsvetan Lazarov Blvd.
Correspondence address	1592 Sofia, 2 Prof. Tsvetan Lazarov Blvd.
Telephone	02 915 3 518
Website	www.cpdp.bg

Art. 20. You may exercise all your rights regarding the protection of your personal data through the forms attached to this information or through the features in your profile. Of course, these forms are not mandatory and you may submit your requests in any form that contains a statement to that effect and identifies you as the data subject.

Art. 21. If consent relates to a transfer, the Controller describes the potential risks of transferring data to third countries in the absence of an adequacy decision and appropriate safeguards.

Art. 22. The Company may amend the Privacy Policy by publishing a notice to that effect on its website.