This Policy is an integral part of the GENERAL TERMS OF USE of the website crystalpeptide.eu (the Website), administered by Crystal Peptides LTD (the Administrator). This document is prepared in accordance with the provisions of Regulation (EU) 2016/679 of the EP and the Council (General Data Protection Regulation or GDPR) and the Personal Data Protection Act. Below is the manner in which the Administrator collects and processes personal data of data subjects – users who visit the Website.

1. Grounds for Processing Personal Data

Processing of personal data is permissible under any of the following conditions:

  • Consent – when users have given their consent for data processing for specific purposes, e.g., for marketing purposes or for establishing contact (by sending an inquiry).
  • Conclusion and performance of a contract – personal data is necessary when concluding a contract to which the data subject is a party, e.g., when registering a user profile on the Website and purchasing products from the online store.
  • Legal obligations – the Administrator is obliged to comply with certain requirements of consumer legislation and personal data protection legislation, and for this purpose may process personal data to fulfill its legal obligations.
  • Legitimate interests – the Administrator may process personal data when filing or responding to reports, complaints, claims to competent state and judicial authorities. It is also in their interest to constantly improve services, and for this purpose may process data to analyze user preferences and feedback when using the Website.

2. Processing of Personal Data

For the best presentation of the Website and for some of its functions, the following data is also collected: IP address; browser type; language settings; device type and operating system through which the Website is accessed; time of use.

The Administrator may process personal data in the course of one or more of the following activities:

  • conclusion, performance and termination of purchase and sale contracts for products;
  • fulfillment of obligations under a concluded contract in accordance with the Consumer Protection Act and the Act on the Provision of Digital Content and Digital Services and the Sale of Goods;
  • management of the online store and fulfillment of legal obligations in accordance with the Electronic Commerce Act;
  • processing of inquiries, complaints and claims;
  • provision of warranty and service maintenance;
  • informing about changes in applied policies and general terms;
  • processing of orders and sending of goods with courier delivery services;
  • issuing invoices and fulfilling legal obligations in accordance with tax and accounting legislation;
  • direct marketing of products and services;
  • evaluation of advertising effectiveness;
  • prevention of fraud in connection with payments;
  • management of profiles and pages on social networks and online platforms;
  • evaluation of satisfaction with provided products and/or services;
  • exercising and protecting legal claims, collecting receivables, filing or responding to reports, complaints, claims to competent state and judicial authorities.

In these activities, the Administrator may collect and process the following categories of data:

  • physical identity data – names, personal identification number (when requesting an invoice for an individual);
  • contact data – phone number, email;
  • delivery data – exact delivery address (personal address or courier office);
  • payment data – information about date and method of payment made;
  • user profile data – email/username, purchase history, delivery data and payment method, and others;
  • Website visit data – IP addresses, system and analytical data collected through installed cookies;
  • other – data shared on the initiative of the data subjects in sent reports, inquiries, applications, objections and feedback.

3. Collection of Personal Data

Personal data may be collected personally from data subjects (when creating a user profile, generating an order, making an inquiry, etc.) and/or automatically through the Website (by using cookies and other similar solutions).

4. Purpose, Basis and Storage Period

More specifically, the Administrator may process data on the following grounds and conditions:

CategoryCollectionPurposeBasis (GDPR)Period
IP address, browser type, language settings, device type, time of use, operating system typeWhen using the website by data subjects and through cookiesTo provide the full functionality of the WebsiteArt. 6(1)(b) – for contract performance2 years
EmailPersonally from data subjects through the “Contacts” section or provided email addressInquiries, comments and feedbackArt. 6(1)(a) – provided consent2 years
Name, Email, Contact phone, Delivery address, Accounting and payment dataWhen ordering by the userFor concluding a purchase contract and fulfilling contractual obligationsArt. 6(1)(b) – processing necessary for contract performanceup to 60 months
Analytical dataWhen using the WebsiteImproving services provided by the Website and statisticsArt. 6(1)(f) – legitimate interestup to 26 months
Marketing data (unique visitor identifier, device identifier, user behavior on the Website, IP addresses)When using the WebsiteUser profiling and ad targeting, content serving and measurement, retargeting and remarketingArt. 6(1)(a) – consent provided by the data subjectup to 26 months or withdrawal of consent

5. Protection of Personal Data

In accordance with applicable legislation, the Administrator maintains appropriate and proportionate technical and organizational measures to protect users’ data, including to prevent unauthorized access to them and/or their improper use.

The Administrator uses business systems, procedures and information technologies that adequately protect personal data and ensure their security. The data collected from Website users is systematized in registers that are subject to cryptographic protection. The data registers themselves are located on the hard drive of computer systems with limited technical and physical access, only by qualified and trained personnel.

6. Sharing of Personal Data

The Administrator may share data on the use of the Website with industry-recognized solutions such as Google Analytics. The Administrator may also share personal data with other contractors assisting in the fulfillment of legal obligations, management of specific work processes and pursuit of certain legitimate interests. Such contractors may be IT and hosting service providers related to the maintenance of the Website.

In certain situations, it may be necessary to share data with a special authority (administrative, judicial and/or executive authority) pursuant to Art. 6(1)(c) and (f) of the General Data Protection Regulation (GDPR), when this is necessary to resolve legal disputes, is provided for in a legal provision or is absolutely necessary to prevent, detect or prosecute criminal activity or fraud.

7. Rights of Data Subjects

Visitors to the Website are data subjects within the meaning of the General Data Protection Regulation (GDPR) and have the following rights:

Right of accessYou have the right to receive confirmation that your personal data is being processed, as well as to request and receive information about the purposes of processing; the categories of personal data processed; the recipients; the sources; the expected storage period; the right to lodge a complaint with a supervisory authority; the existence of automated decision-making, including profiling.
Right to rectificationYou have the right to request the rectification (without undue delay) of inaccurate personal data relating to you. If the data is incomplete, you have the right to request its completion.
Right to erasureYou have the right to request the erasure of personal data relating to you when: they are no longer necessary for the purposes for which they were collected and processed; you withdraw your consent or object to the processing and we have no other legal basis for their processing; your personal data is being processed unlawfully; your personal data must be erased in order to comply with a legal obligation under EU or Member State law.
Restriction of processingYou have the right to request restriction of processing when: the accuracy of your personal data is contested – for a period that allows for verification of the accuracy of the data; the processing is unlawful; we no longer need your personal data, but you require them for the establishment, exercise or defense of legal claims; you have objected to processing and are awaiting verification of our legal grounds and their precedence over your interests.
Right to portabilityYou have the right, when the processing of your data is based on consent or performance of a contractual obligation and at the same time is carried out in an automated manner, to receive without hindrance the personal data relating to you and which you have provided to us, in order to transfer them to another controller.
Right to objectYou have the right, on grounds relating to your particular situation, to object to the processing, including profiling, of your personal data that goes beyond legitimate purposes.
Right to lodge a complaintYou have the right to file a complaint with the Commission for Personal Data Protection for violation of your rights within six months of becoming aware of the violation, but no later than 2 (two) years from its commission. In case of violation of your rights, you may also appeal our acts and actions in court before the competent court.

Users can learn more about their rights and how to exercise them on the information website of the European Data Protection Supervisor or the supervisory authority for the Republic of Bulgaria – Commission for Personal Data Protection.

The User may always and at any time exercise their rights listed above. For this purpose, they need to send a letter or email to the addresses listed below.

Submitted requests regarding personal data will be answered within two months, and in case of need to extend the specified period, the data subject will be informed of the extension, as well as the reasons for the delay.

The Administrator may refuse to process requests that are unreasonably repeated or threaten the confidentiality of other data subjects. The Administrator will provide a free copy of the personal data that is being processed, reserving the right to charge a proportional fee for repeated or excessive requests.