Fraud Blocker
Menu
Menu
Your Cart
For wholesale orders and inquiries »
0

Privacy Policy

Information about the company processing your data:

Name: SHAMBALA TEXTILE LTD

Company ID/BULSTAT: 203306565

Registered office and management address: 37 Osvozhdenie Blvd., 6100 Kazanlak, Bulgaria

Correspondence address: 37 Osvozhdenie Blvd., 6100 Kazanlak, Bulgaria

Phone: +35943163015

E-mail: customersupport@havlia.com

Website: https://havlia.com

Information about the competent supervisory authority for personal data protection

Name: Commission for Personal Data Protection

Registered office and management address: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.

Correspondence address: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.

Phone: 02 915 3 518

Website: www.cpdp.bg

SHAMBALA TEXTILE LTD (hereinafter referred to as the "Administrator" or "Company") operates in accordance with the Personal Data Protection Act and Regulation (EU) 2016/679 of the European Parliament and the Council of April 27, 2016, concerning the protection of individuals regarding the processing of personal data and the free movement of such data. This information aims to inform you about all aspects of the processing of your personal data by the Administrator and your rights concerning this processing.

Where and how do we store your data?

The personal data you provide to us is transmitted via an encrypted connection and stored in a secure database located on the servers of "Jump.BG" Ltd..

We have taken the necessary technical and organizational measures to limit unauthorized access to your personal data, as required under the General Data Protection Regulation (GDPR), which has been in force since 25.05.2018.

We make all reasonable efforts to ensure that your data is stored in complete confidentiality and that there is no risk of unauthorized access by individuals who do not have the right to receive it.

Legal grounds for collecting, processing, and storing your personal data

Article 1. The Administrator collects and processes your personal data in connection with the use of the online store havlia.com and the conclusion of contracts with the company based on Article 6, paragraph 1, of Regulation (EU) 2016/679 (GDPR), specifically on the following grounds:

  • Explicit consent obtained from you as a customer;
  • Performance of the Administrator’s obligations under a contract with you;
  • Compliance with a legal obligation applicable to the Administrator;
  • For the purposes of the Administrator’s or a third party’s legitimate interests.

Purposes and principles in the collection, processing, and storage of your personal data

Article 2. (1) We collect and process the personal data you provide in connection with the use of the online store and the conclusion of a contract with the company, including for the following purposes:

  • Creating an account and providing full functionality when using the online store;
  • Concluding and executing a remote contract;
  • Identifying a party to the contract;
  • Accounting purposes;
  • Statistical purposes;
  • Ensuring information security;
  • Guaranteeing the fulfillment of the contract for the provision of the respective service.
  • Sending a newsletter;
  • Sending an abandoned cart reminder.

What types of personal data does our company collect, process, and store?

Article 3. (1) What personal data do we process?

We will process the following categories of personal data:

  • Contact information such as name, address, email, and phone number
  • Payment information and history
  • Order information
  • Subscription information for email newsletters
  • Username
  • Shopping history
  • Added favorite products
  • Added products for comparison

(2) The company performs the following operations with the provided personal data for the following purposes:

  • Registering a user in the online store and executing a remote sales contract – the purpose of this operation is to create a profile for using the online store for purchasing goods and providing contact details for delivering the purchased goods. Registration and profile creation for using the online store is not a mandatory step in using the service, and it is available to a significant extent without profile creation.
  • Conclusion of an assessment of the impact: Based on the performed impact assessment, the operation "Registering a user in the online store and executing a remote sales contract" is permissible and provides sufficient guarantees for the protection of the rights and legitimate interests of data subjects in accordance with GDPR requirements.
  • Entering and executing a commercial transaction with a client or partner – the purpose of this operation is to enter into and execute a contract with a business partner or client and its administration. Given the limited scope of the collected personal data, conducting an impact assessment of the operation is not necessary.
  • Sending an informational newsletter – the purpose of this operation is to administer the process of sending newsletters to customers. Given the limited scope of the collected personal data, conducting an impact assessment of the operation is not necessary.
  • Exercising the right of withdrawal or making a complaint – the purpose of this operation is to administer the process of exercising the right of withdrawal or filing a complaint by the customer. Given the limited scope of the collected personal data, conducting an impact assessment of the operation is not necessary.

Legal grounds for processing your personal data:

  • Performing a contract with you, as per GDPR Article 6, paragraph 1, letter (b).
  • Processing your data for newsletter subscriptions based on explicit consent – GDPR Article 6, paragraph 1, letter (a).
  • Fulfilling legal obligations imposed on the administrator.

Retention period for your personal data

Article 5. (1) The Administrator stores your personal data for a period no longer than the existence of your account in the online store. After the account is deleted, the Administrator takes the necessary measures to erase and destroy all of your data without unnecessary delay or to anonymize it (i.e., to convert it into a form that does not reveal your identity).

(2) The Administrator processes your personal data provided when placing an order without registration in the online store until the order is completed unless you have explicitly consented during the order process for your data to be processed for service improvement, personalized recommendations, promotions, and statistical purposes.

(3) The Administrator stores personal data related to completed online orders for a period of 5 years for the purpose of protecting the Administrator’s legal interests in legal or administrative disputes with users of the online store.

(4) The Administrator informs you if an extension of the retention period of your data is necessary for compliance with a legal obligation or legitimate interest.

(5) The Administrator stores the personal data required by applicable law for the period specified by the respective regulation, which may exceed the duration of your account or order completion.

Transfer of your personal data for processing

Article 7. (1) The Administrator may, at its discretion, transfer part or all of your personal data to personal data processors for the purposes of processing, to which you have consented, in compliance with Regulation (EU) 2016/679 (GDPR).

(2) The Administrator informs you in the event of an intention to transfer part or all of your personal data to third countries or international organizations.

Your rights regarding the collection, processing, and storage of your personal data

Withdrawal of consent for processing personal data

Article 8. (1) If you do not wish for the personal data you have provided to be processed for marketing purposes and receiving newsletters, you may withdraw your consent for processing at any time by sending an email request.

(2) After receiving your request, we will send an email with detailed instructions for verification of your identity as the recipient of newsletters and the data subject for which consent withdrawal is requested. Upon successful verification, the processing of your personal data will cease.

(3) Withdrawal of consent does not affect the lawfulness of the processing carried out by the Administrator up to that point.

Right of access

Article 9. (1) You have the right to request and obtain confirmation from the Administrator as to whether personal data concerning you is being processed by sending a free-text email request.

(2) You have the right to access your data, as well as information regarding its collection, processing, and storage.

(3) After receiving your request, we will send an email with detailed verification instructions to the email address used for registration or placing orders.

(4) Once verification is successfully completed, the Administrator will provide, upon request, a copy of the processed personal data related to you in an electronic or other appropriate format.

(5) Providing access to the data is free of charge; however, the Administrator reserves the right to impose an administrative fee in case of repeated or excessive requests.

Right to rectification or completion

Article 10. (1) You may correct or complete incorrect or incomplete personal data related to you at any time using the "Edit Profile" option.

(2) You can also correct or complete incorrect or incomplete personal data by sending a request to the Administrator via email.

Right to Erasure ("Right to Be Forgotten")

Article 11.

(1) You have the right to request the Administrator to delete part or all of your personal data, and the Administrator is obliged to delete it without undue delay when one of the following grounds applies:

  • The personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
  • You withdraw your consent on which the processing is based, and there is no other legal basis for the processing;
  • You object to the processing of your personal data, including for direct marketing purposes, and there are no overriding legitimate grounds for the processing;
  • The personal data has been unlawfully processed;
  • The personal data must be deleted to comply with a legal obligation under EU law or the law of a Member State applicable to the Administrator;
  • The personal data was collected in relation to the offering of information society services.
  • For the exercise of the right to freedom of expression and the right to information;
  • For compliance with a legal obligation requiring processing under EU law or the law of a Member State applicable to the Administrator, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Administrator;
  • For reasons of public interest in the field of public health;
  • For archival purposes in the public interest, for scientific or historical research purposes, or for statistical purposes;
  • For the establishment, exercise, or defense of legal claims.
Right to Restriction of Processing
You have the right to request the Administrator to restrict the processing of your personal data if one of the following applies:
  • The accuracy of the personal data is contested by the data subject, for a period enabling the Administrator to verify the accuracy of the personal data;
  • The processing is unlawful, but the data subject does not wish the personal data to be erased and instead requests the restriction of its use;
  • The Administrator no longer needs the personal data for the purposes of processing, but the data subject requires it for the establishment, exercise, or defense of legal claims;
  • The data subject has objected to processing under Article 21, Paragraph 1, pending verification of whether the legitimate grounds of the Administrator override those of the data subject.

(2) The Administrator is not obliged to delete personal data if it is stored and processed:

(3) To exercise your right to be forgotten, you must send an email request for the deletion of your personal data processed by the Administrator by filling out the form in Appendix No. 2 or by submitting a free-text request. The Administrator will then send an email to the address used for registration or placing orders in the online store with detailed verification instructions to confirm your identity as a user of the store and the data subject for whom the deletion request is made.

(4) Once the identity of the requester is verified and confirmed to match the data subject in accordance with the provided instructions, we will delete all data we process about you as per paragraph 3.

(5) If you have placed an order or if there is another legal basis for denying your request to be "forgotten," we will inform you of this in detail and in a timely manner.

Article 12.

When processing is restricted under paragraph 1, such data may be processed, except for storage, only with the consent of the data subject or for the establishment, exercise, or defense of legal claims, or for the protection of the rights of another natural person, or for important reasons of public interest for the Union or a Member State.

When a data subject has requested restriction of processing under paragraph 1, the Administrator will inform them before lifting the restriction.

(1) Once we receive your request, we will send an email to the address used for registration or placing orders in the online store with detailed verification instructions to confirm your identity as a store user and data subject requesting restriction of processing.

(2) After verification as per paragraph 2, the Company will suspend the processing of your personal data.

Right to Data Portability

Article 13.
(1) If you have given consent for the processing of your personal data, or if processing is necessary for the performance of a contract with the Administrator, or if your data is processed automatically, you may:

  • Request the Administrator to provide your personal data in a readable format so that you can transfer it to another Administrator;
  • Request the Administrator to directly transfer your personal data to an Administrator of your choice, where technically feasible.

(2) You can exercise the right to data portability by sending a completed form (Appendix No. 3) or a free-text request via email. The Administrator will then send an email to the address used for registration or placing orders in the online store, providing detailed verification instructions to confirm your identity as a user of the store and the data subject for whom the portability request is made.

(3) After verification in accordance with paragraph 2, the Company will send your data in an appropriate electronic format to the email address you specified.

Right to Object

Article 14.
You may object at any time to the processing of your personal data by the Administrator, including when it is processed for profiling or direct marketing purposes.

Your Rights in Case of a Personal Data Security Breach

Article 15.
(1) If the Administrator detects a personal data security breach that may pose a high risk to your rights and freedoms, you will be notified without undue delay about the breach and the measures taken or to be taken.

(2) The Administrator is not required to notify you if:

  • Appropriate technical and organizational protection measures have been implemented regarding the data affected by the security breach;
  • Subsequent measures have been taken to ensure that the breach does not result in a high risk to your rights;
  • Notification would require disproportionate efforts.

Data Sharing

Article 16.
The Company engages third parties to assist with certain contractual activities or to fulfill legal obligations. We do not provide your personal data to third parties without ensuring that all necessary technical and organizational security measures have been taken. We strive to exercise strict control over this process. Some recipients of personal data may include:

  • Delivery companies, courier services, external consultants and specialists, banks, security companies, entities maintaining software and hardware used for data processing, hosting providers, commercial agents, marketing and advertising agencies, and others.

In some cases, the provision of personal data is mandatory to comply with legal obligations, including regulatory authorities such as government commissions, institutions, agencies, the National Revenue Agency (NRA), the National Social Security Institute (NSSI), courts, prosecutors, and other bodies to whom we are legally required to disclose personal data.

International Data Transfers

Article 17.
The Administrator does not transfer your data to third countries.

Complaints and Legal Remedies

Article 18.
In case of a violation of your rights under the above provisions or applicable data protection laws, you have the right to file a complaint with the Commission for Personal Data Protection.

Appendix No. 1

Form for Withdrawal of Consent for Processing Purposes

Your Name: …………………….
Your Email Used in the Online Store: …………………….
Contact Email: …………………….

To:
Company Name: …………………….
Company Registration Number (EIK/BULSTAT): …………………….
Registered Office and Address: …………………….
Correspondence Address: …………………….
Phone: …………………….
Email: …………………….
Website: …………………….

I hereby withdraw my consent for the processing of my personal data provided for receiving newsletters, promotional messages, or other marketing materials. I acknowledge that I am aware of the terms of consent withdrawal in accordance with the Mandatory Information on Personal Data Protection Rights of the online store.

In case of a violation of your rights under the above provisions or applicable data protection laws, you have the right to file a complaint with the Commission for Personal Data Protection, as follows:

Name: Commission for Personal Data Protection
Registered Office and Address: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.
Correspondence Address: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.
Phone: +359 2 915 3 518
Website: www.cpdp.bg

Appendix No. 2

Request to Be Forgotten – Deletion of Personal Data

Your Name: …………………….
Your Email Used for Registration or Orders in the Online Store: …………………….
Contact Email: …………………….

To:
Company Name: …………………….
Company Registration Number (EIK/BULSTAT): …………………….
Registered Office and Address: …………………….
Correspondence Address: …………………….
Phone: …………………….
Email: …………………….
Website: …………………….

I request that all personal data collected, processed, and stored about me, whether provided by myself or third parties, be deleted from your databases.

I declare that I am aware that part or all of my personal data may continue to be processed and stored by the Administrator to fulfill its legal obligations.

In case of a violation of your rights under the above provisions or applicable data protection laws, you have the right to file a complaint with the Commission for Personal Data Protection, as follows:

Name: Commission for Personal Data Protection
Registered Office and Address: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.
Correspondence Address: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.
Phone: +359 2 915 3 518
Website: www.cpdp.bg

Appendix No. 3

Request for Personal Data Portability

Your Name: …………………….
Your Email Used for Registration or Orders in the Online Store: …………………….
Contact Email: …………………….

To:
Company Name: …………………….
Company Registration Number (EIK/BULSTAT): …………………….
Registered Office and Address: …………………….
Correspondence Address: …………………….
Phone: …………………….
Email: …………………….
Website: …………………….

I request that all my personal data collected, processed, and stored in your databases be sent in XML format to:

Email: …………………….
Receiving Administrator: …………………….
Company Name: …………………….
Identification Number (EIK, BULSTAT, or registration number at the CPDP): …………………….
Email: …………………….

In case of a violation of your rights under the above provisions or applicable data protection laws, you have the right to file a complaint with the Commission for Personal Data Protection, as follows:

Name: Commission for Personal Data Protection
Registered Office and Address: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.
Correspondence Address: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.
Phone: +359 2 915 3 518
Website: www.cpdp.bg

Appendix No. 4

Request for Data Correction

Your Name: …………………….
Your Email Used for Registration or Orders in the Online Store: …………………….
Contact Email: …………………….

To:
Company Name: …………………….
Company Registration Number (EIK/BULSTAT): …………………….
Registered Office and Address: …………………….
Correspondence Address: …………………….
Phone: …………………….
Email: …………………….
Website: …………………….

I request the following personal data, collected, processed, and stored about me by your company, to be corrected as follows:

Data to be corrected:
…………………………………………..

Requested correction:
…………………………………………..

In case of a violation of your rights under the above provisions or applicable data protection laws, you have the right to file a complaint with the Commission for Personal Data Protection, as follows:

Name: Commission for Personal Data Protection
Registered Office and Address: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.
Correspondence Address: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.
Phone: +359 2 915 3 518
Website: www.cpdp.bg

If a dispute arises that cannot be resolved directly with the online store, you may use the Online Dispute Resolution (ODR) platform.

All products listed on the website are subject to updates. The information on the website may change at any time without prior announcement.