Information about the data controller:

KIKA GROUP LTD is a company registered under the Commercial Act of the Republic of Bulgaria with UIC 203763896, address Plovdiv 121 Vasil Levski Street, email address office@kikkaboo.com, telephone 032 515151

Grounds and purposes for which we use your personal data

We process your personal data on the following grounds:

• Contracts concluded for the delivery of our products;
• Explicit consent from you - the purpose is stated on a case-by-case basis;
• When there is a statutory obligation for this.

In the following paragraphs you will find detailed information about the processing of your personal data depending on the grounds on which we process it.

1. For fulfilling a contract

We process your personal data in order to fulfil our contractual and pre-contractual obligations and to exercise our rights under the contracts concluded with you.

Objectives of the processing:

• Establishing your identity;
• Providing the features of our website;
• Preparing and sending an invoice for the services you purchase from us;
• To detect and/or prevent unlawful acts or acts contrary to our Terms and Conditions.

Data that we process on these grounds:

On the grounds of the contract concluded between us and you, we process information about the type and content of the contractual relationship as well as any other information related to the contractual relationship, including:

• Personal contact details - address, email, phone number;
• Identification details - full name, personal identification number or personal umber of a foreign citizen, address;
• Data on the made orders;
• Correspondence relating to the overall servicing - emails, letters, information about your requests for troubleshooting, complaints, petitions, feedback that we receive from you;
• Credit or debit card information, bank account number or other banking and payment information relating to the made payments;
• Other information such as: IP address when visiting our website; demographic data; information from your actions on the site.

The processing of the above personal data is mandatory for us in order to be able to conclude the contract with you and to fulfil it. If you do not provide this data to us, we would be unable to fulfil our obligations under the contract.

We provide personal data to third parties

We may provide your personal data to third party subcontractors, including courier service providers, for the purposes of delivering the goods you have ordered or, subject to your express consent, for direct marketing purposes.

When we delete the data collected on these grounds

We delete the data collected on these grounds 2 years after the termination of the contractual relationship, regardless if this is due to the expiry of the contract, termination or any other reason.

1. To fulfil statutory obligations.

There may be a legal obligation for us to process your personal data. In these cases we are obliged to carry out the processing, for example:

• Obligations under the Measures Against Money Laundering Act;
• The fulfilment of obligations in relation to distance selling and off-premises selling provided for in the Consumer Protection Act;
• Providing information to the Commission for Consumer Protection or to third parties in accordance with the Consumer Protection Act;
• Providing information to the Commission for Personal Data Protection in relation to obligations stipulated in the data protection legislation;
• Obligations stipulated in the Accounting Act and the Tax and Social Security Procedures Code and other related legal acts in relation to keeping lawful accounting;
• Providing information to the court and third parties, within court proceedings, in accordance with the requirements of the regulations applicable to the proceedings;
• Age verification when shopping online.

When we delete personal data collected on these grounds

We delete data collected in compliance to a obligation stipulated in the legislation once the obligation to collect and store has been fulfilled or has been cancelled.

1. After you give your consent

We process your personal data on these grounds only after your explicit, unambiguous and voluntary consent. We will not plan any adverse consequences for you if you refuse to give consent for the processing of personal data.

Consent is separate grounds for processing your personal data and the purpose of the processing is set out in it and is not covered by the purposes listed in this policy. If you grant us the respective consent and until you withdraw it or terminate any contractual relationship with us, we shall make product/service suggestions that are suitable for you by carrying out detailed analyses of your basic personal data;

Data that we process on these grounds:

On these grounds we may process personal data for direct marketing purposes, including website usage data.

Provision of data to third parties

On these grounds we may provide your data to marketing agencies, Facebook, Google or similar parties.

Withdrawal of Consent

The granted consents may be withdrawn at any time. Withdrawal of consent shall have no effect on the fulfilment of the contractual obligations. If you withdraw your consent to the processing of personal data for any or all of the ways described above, we will not use your personal data and information for the purposes set out above. Withdrawal of consent shall not affect the lawfulness of processing based on consent prior to its withdrawal.

To withdraw your consent, you only need to use our website or simply our contact details.

When we delete the data collected on these grounds

We delete data collected on this basis at your request or 12 months after its initial collection.

 

1. How we protect your personal data

To ensure adequate protection of the company's and its customers' data, we apply all necessary organizational and technical measures stipulated in the Personal Data Protection Act.

The company has established rules to prevent misuse and security breaches which assist the procedures for protecting and securing your data.

In order to maximize the security of the processing, transmission and storage of your data, we may use additional security mechanisms such as encryption, pseudonymization, etc.

 

1. User Rights

Each User of the Site enjoys all the rights for the protection of personal data under Bulgarian and European Union law.

The user can exercise their rights by sending a message to our email address.

Each User is entitled to:

• Being informed (in relation to the processing of their personal data by the controller);
• Access their own personal data;
• Correction (if data is inaccurate);
• Erasure of personal data (right to be forgotten);
• Restriction of processing by the data controller or processor;
• Portability of personal data between controllers;
• Objection to processing of personal data;
• The data subject shall also have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal consequences for him or her or similarly significantly affects them;
• Right to a judicial or administrative remedy if the data subject's rights have been violated.

 The User may request deletion if one of the following conditions applies:

• The personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
• The User withdraws their consent on which the data processing is based and there is no other legal basis for the processing;
• The user objects to the processing of the data and there are no statutory grounds for the processing that prevail;
• The personal data has been unlawfully processed;
• The personal data must be deleted in order to comply with a legal obligation under the legislation of the European Union or a Member State which applies to the controller;
• The personal data was collected in connection with the provision of information society services to children and consent was given by the person with parental responsibility for the child.

The User has the right to restrict the processing of their personal data by the controller when:

• They challenge the accuracy of the personal data. In this case, the restriction of processing shall be for a period which allows the controller to verify the accuracy of the personal data;
• the processing is unlawful but the User opposes their erasure and requests the restriction of their use instead
• The controller no longer needs the personal data for the processing, but the User requires them for the establishment, exercise or defence of legal claims;
• They object to the processing because they are waiting for an inspection whether the legitimate grounds of the controller override the interests of the User.

 

Right to portability.

The data subject shall have the right to obtain the personal data concerning them, which they have provided to a controller, in a structured, commonly used and machine-readable format and shall have the right to transfer those data to another controller without hindrance from the controller to whom the personal data have been provided when the processing is based on consent or a contractual obligation and the processing is carried out by automated means. When exercising their right to data portability, the data subject shall also have the right to obtain a direct transfer of personal data from one controller to another, where technically feasible.

Right to object.

Users have the right to object to the controller to the processing of their personal data. The controller shall be obliged to terminate the processing unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims. If the User objects to the processing of personal data for direct marketing purposes, the processing shall be terminated immediately.

Complaint to the Supervisory Authority

Each User has the right to lodge a complaint against unlawful processing of his/her personal data with the Personal Data Protection Commission or the competent court.

 

Use of cookies

Cookies are short text files or small packets of information that are stored by your Internet browser on your end device (computer, tablet, laptop or mobile phone) when you visit different websites and pages on the Internet. The main purpose of cookies is to make the user recognizable when they return to the Website. Some cookies also have more specific uses, such as recording user behaviour on the site and making it easier for the user to use the Website. More information on how cookies work can be found on the Internet.

 

How are cookies used on this Website?

We use cookies on this Website primarily to facilitate the usability of the Website, improve its performance and store information about user behaviour. No personal data is stored during this process, i.e. we cannot identify you as an individual through the cookies on the site, therefore the Personal Data Protection Act does not apply to the collection of this information. The information collected from cookies is usually used in an aggregate form to analyse user behaviour on the Website, which allows us to improve the functionality of the Website, the user paths and the content used.

 

What cookies are used on this Website?

Session cookies

This type of cookies makes it easier for you to use the Website, as they store information temporarily, only within the session of the browser used. Typically, the information that is stored through them is what goods or services you have added to your basket, which pages of the Website you have visited and how you have reached specific information. These cookies do not collect information from your end device and are automatically deleted when you leave the Website or terminate your browser session.

Permanent cookies

They enable us to store specific browsing information, such as analysing the visits to the Website, how you arrived at the Website, what pages you viewed, what options you selected, and where you went through that Website. Tracking this information enables us to make improvements to the Website, including correcting errors and expanding content. The retention period for this type of cookies varies according to their specific purpose.

Third party cookies

On our Website there are links to other websites or embedded content from other websites, for example from Facebook, Instagram, YouTube, Twitter, LinkedIn, partner websites. It is possible that cookies from these websites may be stored on your terminal device when you visit these websites or open content from them. It is these cookies that are defined as third party cookies and we have no control over the generation and management of these cookies. We therefore advise you to look up information about them and how they are managed on the websites of the third parties concerned.

How can I manage the use of cookies on this Website?

All browsers allow cookies to be managed from a folder created by your browser for this purpose. You can block the receiving of cookies, delete all or part of them or set your preferences regarding the use of cookies before you initiate a visit to our site. Please note that deleting or blocking cookies may adversely affect the functionality of our Website and therefore your user experience on it.

 

Disabling or blocking cookies

Controlling, disabling or blocking cookies is managed from your browser settings. Please note that the complete prohibition of the use of all cookies may affect the functional performance of the site, its effectiveness and the ability to access certain information.

We would like you to know that we use cookies on the basis of Article 4a of the Electronic Commerce Act (ECA) and Article 6, Para. 1 (f) of the GDPR.

If you do not consent to this, you can refuse storage by setting your browser to inform you when a site wants to store cookies on your device and you can accept or not accept them accordingly.