Privacy policy

Data Protection Policy at MartiniShops 

"MM STYLE 1 LTD" 
UIC: 208490437
address: 3 Pleven St., Ruse region, Ruse city 7000, Bulgaria,
phone: +359 877 817 616 and
email address: info@martinishops.com,
applies these General Terms and Conditions in its commercial relations with Clients ("Controller" or "MM STYLE 1"),

PREAMBLE

MM STYLE 1, as a personal data controller, collects and processes certain information about natural persons.
This information may relate to employees, managers, clients, suppliers, contractors, business contacts, and other natural persons with whom the Controller has a relationship or wishes to establish business contact.
This personal data protection policy regulates how personal data should be collected, processed, and stored to meet the standards within the Controller's organization and comply with legal requirements.

I. Legal basis

This Personal Data Protection Policy ("Policy") is issued based on the Personal Data Protection Act and its subordinate acts, as amended ("Bulgarian legislation"), and the General Data Protection Regulation (EU) 2016/679 ("GDPR").
Bulgarian legislation and the GDPR provide rules on how organizations, including MM STYLE 1, must collect, process, and store personal data. These rules apply to the Controller regardless of whether the data is processed electronically, on paper, or on other media.
To ensure that the processing of personal data complies with legal requirements, personal data is collected and used lawfully, stored securely, and the Controller takes necessary measures to prevent the processed personal data from being subject to unlawful disclosure.
The personal data controller is familiar with and follows the principles provided in the GDPR:
- personal data is processed lawfully, fairly, and transparently;
– personal data is collected for specific, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes;
- personal data is adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed;
– personal data is accurate and, where necessary, kept up to date;
- personal data is stored in a form that allows the identification of the data subjects for a period no longer than necessary for the purposes for which the personal data are processed;
– personal data is processed in a manner that ensures an appropriate level of security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, by applying appropriate technical or organizational measures.

II. Objectives of the Policy

This Policy aims for the Administrator to:
– comply with applicable personal data legislation and follow established best practices;
– establish mechanisms for maintaining, supporting, and protecting the reporting registers;
– establish the duties of officials processing personal data and/or persons who have access to personal data and work under the supervision of those processing personal data, their responsibility in case of failure to fulfill these duties;
– protect the rights of staff, clients, and partners;
– be transparent about how it stores and protects the personal data of individuals;
– establish the necessary technical and organizational measures to protect personal data from unlawful processing (accidental or unlawful destruction, accidental loss, unlawful access, alteration or dissemination, as well as all other unlawful forms of personal data processing);
– be protected against the risk of violations.

III. Scope

This Policy applies to the processing of personal data of suppliers, human resources, clients, and partners, as described in the electronic reporting registers established in accordance with this Policy, Bulgarian legislation, and Article 30 of the GDPR (“Records of processing activities”).

IV. Collection of personal data

Categories of data and subjects
“Personal data” means any information relating to an identified or identifiable natural person (“Data Subject”), namely:
The Administrator collects personal data regarding the following categories of persons:
– persons representing the companies with which the Administrator has business relationships;
– contact persons in companies with which the Administrator has business relationships;
– persons interested in receiving informational services – newsletters, directories, etc.;
– persons who register for the purpose of using the online store.
Purposes of data collection
The Administrator collects personal data in connection with the fulfillment of the following purposes:
1. For the performance of activities related to the conclusion, existence, modification, and termination of contractual relationships, including:
– preparation of any documents;
– to establish contact with the contact person by phone, fax, or any other lawful means;
– for delivery and/or acceptance of goods/services, for communication related to the provision and/or receipt of goods/services, and for providing related customer service;
– For maintaining accounting records related to the performance of contracts in which the Administrator is a party;
– For processing payments related to contracts concluded by the Administrator;
– For sending important information to the subjects regarding changes in the Administrator's rules, conditions, and policies and/or other administrative information;
2. For marketing purposes – after obtaining explicit consent from the data subjects;
3. For statistical purposes.
Data collection
Data of contractors (managers, representatives, and/or contact persons of the legal entity under a commercial contract)
Personal data for each individual is provided voluntarily by the individuals themselves and collected by the Administrator in fulfillment of a regulatory obligation, in connection with the conclusion of a contract and/or the fulfillment of obligations under a concluded contract according to the provisions of the Commercial Law, Accounting Act, Obligations and Contracts Act, Value Added Tax Act, and others, and the conditions specified in a commercial contract with the respective client through: paper carrier – written documents (including powers of attorney, contracts, attachment notices, bank information, etc.), by email – provided in connection with the execution of a commercial contract and/or by filling out a registration form. Individuals are notified of the provisions of this Policy in advance or at the time of receiving their data.

V. Legitimate interests pursued by the Administrator

In connection with the processing of data of managers and contractors:
The data processing is carried out on the basis of legitimate interest and in connection with the conclusion, existence, modification, and termination of commercial and civil contracts in the application and fulfillment of the regulatory requirements of the Commercial Law, Social Security Code, Tax and Social Security Procedure Code, Insurance Code, Personal Income Tax Act, Accounting Act, Obligations and Contracts Act, and others.

VI. Transparency. Rights of individuals whose data is processed by the Administrator

Transparency and conditions for exercising the rights of individuals
The Administrator provides information to individuals in a brief, transparent, understandable, and easily accessible form, in clear and simple language.
The Administrator strives to ensure that individuals are informed about the personal data processed by them and that the individuals fully and completely understand and are informed regarding the processing in accordance with the requirements of the GDPR and Bulgarian legislation.
The Controller shall provide the information to the data subjects in writing or by other means, including, where appropriate, by electronic means. If the data subject has requested it, the information may be provided orally, provided that the identity of the data subject is proven by other means.
The Controller shall provide the data subjects free of charge with information on the actions taken in relation to a request concerning their right of access, correction, deletion, restriction of processing, portability, objection, and automated decision-making, without undue delay and in any event within one month of receipt of the request.
If necessary, this period may be extended by two further months taking into account the complexity and number of the requests. The Controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the data subject submits the request by electronic means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject.
If the Controller does not take action on the request, the Controller shall inform the data subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and of the possibility of lodging a complaint with a supervisory authority and seeking judicial remedy.
When the requests of the data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the Controller may either:
– to impose a reasonable fee taking into account the administrative costs of providing the information or communication or taking the requested action, or
– to refuse to act on the request.
Right of access of the data subjects
Every person has the right to obtain from the Controller confirmation as to whether or not personal data concerning them are being processed, and, where that is the case, access to the data and the following information:
– the purposes of the processing;
– the relevant categories of personal data;
– the recipients or categories of recipients to whom the personal data have been or will be disclosed (including in third countries or international organizations);
– where possible, the envisaged period for which the data will be stored, or if that is not possible, the criteria used to determine that period;
– the existence of the right to request from the Controller the correction or deletion of personal data or the restriction of the processing of personal data related to the data subjects, or to object to such processing;
– the right to lodge a complaint with the Commission for Personal Data Protection;
– when personal data are not collected from the data subjects themselves, any available information as to their source;
– the existence of automated decision-making, including profiling, and at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the persons.
When personal data are transferred to a third country or to an international organization, the persons have the right to be informed about the appropriate safeguards related to the transfer.
The Controller shall provide the person with a copy of the personal data undergoing processing. For additional copies requested by the persons, the Controller may charge a reasonable fee based on administrative costs. When the person submits a request by electronic means, the information shall be provided, where possible, in a commonly used electronic form, unless the person has requested otherwise.
Right to rectification
Any person whose data are processed by the Controller has the right to request the Controller to rectify without undue delay inaccurate personal data concerning him. Considering the purposes of the processing, the person has the right to have incomplete personal data completed.
Right to erasure (right to be forgotten)
Any person whose data are processed by the Controller has the right to request the Controller to delete the personal data concerning him without undue delay, and the Controller has the obligation to delete the personal data without undue delay when:
– the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
– the data subject has withdrawn consent on which the processing is based and there is no other legal ground for the processing;
– the data subject has objected to the processing and there are no overriding legitimate grounds for the processing;
– the personal data have been processed unlawfully;
– the personal data must be deleted in order to comply with a legal obligation applicable to the controller;
– the personal data have been collected in connection with the provision of information society services.
When the Controller has made the personal data public and is obliged under the previous paragraph to delete the personal data, he, taking into account the available technology and the costs of implementation, takes reasonable steps, including technical measures, to inform the controllers processing the personal data that the data subject has requested the deletion by those controllers of all links, copies, or replicas of his personal data.
Right to restriction of processing
Any person whose data are processed by the Controller has the right to request restriction of processing from the Controller when one of the following applies:
– the accuracy of the personal data is contested by the individual, for a period enabling the Controller to verify the accuracy of the personal data;
– the processing is unlawful, but the data subject does not want the personal data to be erased and instead requests restriction of their use;
– the Controller no longer needs the personal data for the purposes of processing, but the data subject requires them for the establishment, exercise, or defense of legal claims;
– the data subject has objected to the processing pending verification whether the legitimate grounds of the Controller override the interests of the data subject.
When processing is restricted pursuant to the above paragraph, such data shall be processed, except for storage, only with the consent of the data subject or for the establishment, exercise, or defense of legal claims or for the protection of the rights of another natural person or for important reasons of public interest.
When a data subject has requested restriction of processing, the Controller shall inform them before lifting the restriction on processing.
Obligation to notify upon rectification or erasure of personal data or restriction of processing
The Controller shall communicate any rectification, erasure, or restriction of processing to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The Controller shall inform the data subject about those recipients if the data subject requests it.
Right to data portability
The data subject has the right to receive the personal data concerning them which they have provided to the Controller, in a structured, commonly used and machine-readable format, and has the right to transfer those data to another controller without hindrance from the Controller, when (i) the processing is based on consent related to specific purposes or on a contractual obligation of the subject or the taking of steps prior to entering into a contract, and (ii) the processing is carried out by automated means.
When exercising their right to data portability, the data subject has the right to receive a direct transfer of personal data from one controller to another, when technically feasible.
Right to object
The data subject has the right, at any time and on grounds relating to their particular situation, to object to the processing of personal data concerning them (when the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Administrator, or the processing is for the purposes of the legitimate interests of the Administrator or a third party), including profiling. The Administrator shall cease processing the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims.
When personal data is processed for direct marketing purposes, the data subject has the right at any time to object to the processing of personal data concerning them for this type of marketing, which includes profiling insofar as it is related to direct marketing. When the data subject objects to processing for direct marketing purposes, the processing of personal data for these purposes ceases.
At the latest, at the moment of the first contact with the data subject, they are explicitly informed about the existence of the right under the previous paragraphs, which is presented clearly and separately from any other information.

VII. Technical and organizational measures for data protection

The protection of data on paper copies, as well as on electronic media, from unauthorized access, damage, loss, or destruction is ensured through a series of internally regulated technical and organizational measures.

VIII. Transfer of personal data

The Administrator does not and will not transfer personal data to countries outside the European Union.

IX. Breaches. Notification of breaches

Breaches
A data security breach occurs when the personal data for which MM STYLE 1 is responsible is affected by a security incident resulting in a breach of the confidentiality, availability, or integrity of the personal data. In this sense, a data breach occurs when there is a security breach leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of data that is transmitted, stored, or otherwise processed.
In the event of a personal data security breach, notification must be made immediately.
Once the respective employee of MM STYLE 1 EOOD receives information about a violation, they must determine whether the specific event constitutes a personal data breach and notify the Administrators of the Administrator about the event (if they are not already aware).
In the event of a personal data security breach that is likely to result in a risk to the rights and freedoms of individuals, the Administrator (through the relevant employee), without undue delay and where feasible — no later than 72 hours after becoming aware of it, notifies the Commission for Personal Data Protection of the breach.
When and to the extent that it is not possible to provide the information simultaneously, the information may be provided in stages without further undue delay.
When there is a likelihood that the personal data security breach will result in a high risk to the rights and freedoms of individuals, the Administrator promptly notifies the data subject of the breach.
The Administrator documents every personal data security breach, including the facts related to the breach, its consequences, and the actions taken to address it.

X. Destruction

Accounting and commercial information, as well as all other data and documents relevant to taxation and mandatory social security contributions, are kept by the Administrator for the following periods:
– payroll records – 50 years;
– accounting registers and financial statements – 10 years;
– documents for tax and social security control – 5 years after the expiration of the limitation period for settling the related public obligation;
– all other carriers – 5 years.
After the expiration of the retention period, information carriers (paper or technical) that are not subject to transfer to the National Archival Fund may be destroyed.
After the retention period expires, the data shall be destroyed as soon as possible by shredding the paper carriers, and by erasing and deleting the corresponding files from the Company's computers for the technical carriers.
Additional provisions
For the purposes of these internal rules:
§ 1. "Personal data controller" is "MM STYLE 1" LTD, a single-member limited liability company, with UIC 208490437.
§ 2. "Processing" means any operation or set of operations performed on personal data or a set of personal data by automated or other means such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making the data accessible, alignment or combination, restriction, erasure or destruction;
§ 3. This Policy is subject to approval and communication to the persons concerned by an order of the Administrator's manager.
The policy is approved by the managers of MM STYLE 1 LTD: 19.09.2025
The policy is effective from: 19.09.2025