Data Protection Policy of Globus Commerce Ltd.
Globus Commerce Ltd., with its address at Sofia, 47 Angel Voyvoda Street, VAT No. BG040775689, phone: 02-8403226, email: office@globuscommerce.com, applies the following policy in its commercial relations with its clients:
Globus Commerce Ltd. collects and processes certain information about natural persons in connection with commercial contacts. This Data Protection Policy regulates how personal data is collected, processed, and stored in compliance with legal requirements.
I. Legal Basis
This Data Protection Policy is based on the Personal Data Protection Act and its implementing regulations, as well as the General Data Protection Regulation (EU) 2016/679 (GDPR).
The rules provided by Bulgarian legislation and GDPR apply to Globus Commerce Ltd. regardless of whether the data is processed electronically, on paper, or on other media. Personal data is collected and used lawfully, securely stored, and Globus Commerce Ltd. takes the necessary measures to prevent unlawful disclosure of personal data.
Globus Commerce Ltd. follows the principles outlined in GDPR:
- Personal data is processed lawfully, fairly, and transparently;
- Personal data is collected for specified, legitimate purposes and is not processed in a manner incompatible with those purposes;
- Personal data is limited to what is necessary and related to the purposes for which it is processed;
- Personal data is accurate and, when necessary, kept up to date;
- Personal data is kept in a form that allows identification of the data subjects for no longer than necessary for the purposes for which the data is processed;
- Personal data is processed in a way that ensures an appropriate level of security, including protection against unauthorized or unlawful processing, and accidental loss, destruction, or damage, by applying appropriate technical or organizational measures.
- To ensure compliance with applicable legislation regarding personal data and to follow established best practices;
- To establish mechanisms for maintaining and protecting record-keeping registers;
- To establish the obligations of persons processing personal data and/or those with access to personal data and working under the direction of data processors, and their responsibility in case of failure to comply with these obligations;
- To protect the rights of staff, clients, and partners;
- To define how personal data of individuals is stored and protected;
- To establish necessary technical and organizational measures to protect personal data from unlawful processing (including accidental or illegal destruction, loss, unauthorized access, alteration, or dissemination, as well as other illegal forms of personal data processing);
- To ensure protection in case of data breach risks.
This policy applies to the processing of personal data of contractors, suppliers, clients, and partners, as described in the electronic record-keeping registers established in accordance with this policy, Bulgarian legislation, and Article 30 of the GDPR.
IV. Collection of Personal Data
Categories of data and subjects: Personal data is any information relating to an identified or identifiable natural person (Data Subject):
- Individuals representing companies with which Globus Commerce Ltd. has business relationships;
- Contact persons in companies with which the Administrator has business relationships;
- Individuals interested in receiving informational services – newsletters, directories, etc.;
- Individuals who register to use the online store.
- To perform activities related to the conclusion, existence, amendment, and termination of contractual relationships, including for:
- Preparing documents;
- Establishing contact with the person by phone, fax, or any other lawful means;
- Delivery and/or receipt of goods/services, communication related to providing and/or receiving goods/services, and providing related customer service;
- Accounting in relation to contracts in which Globus Commerce Ltd. is a party;
- Processing payments related to concluded contracts by Globus Commerce Ltd.;
- Sending important information to the data subjects regarding changes in the rules, conditions, and policies of Globus Commerce Ltd. and/or other administrative information.
- For marketing purposes – with explicit consent from the data subjects.
- For statistical purposes.
Data of contractors (managers, representatives, and/or contact persons of the legal entity under a commercial agreement):
Personal data for each individual is provided voluntarily by the individuals and is collected by Globus Commerce Ltd. to comply with legal obligations, in connection with the conclusion of a contract, and/or the fulfillment of obligations under the concluded contract according to the provisions of the Commercial Code, the Accounting Act, the Obligations and Contracts Act, the VAT Act, etc. and the terms specified in the commercial contract with the respective client via paper documents (e.g., powers of attorney, contracts, notifications of attachments, bank details, etc.), via email provided in connection with the execution of a commercial contract, or by completing a registration form. The individuals are notified of the provisions of this Policy beforehand or at the moment of data collection.
V. Legitimate Interests Pursued by Globus Commerce Ltd.
In relation to the processing of data of managers and contractors: data processing is based on a legitimate interest and is related to the conclusion, existence, modification, and termination of commercial and civil contracts in compliance with the requirements of the Commercial Code, Social Security Code, Tax-Insurance Procedure Code, Insurance Code, Income Tax Act, Accounting Act, Obligations and Contracts Act, etc.
VI. Transparency. Rights of Individuals Whose Data Is Processed by Globus Commerce Ltd.
Globus Commerce Ltd. provides information to individuals in a concise, transparent, intelligible, and easily accessible form, using clear and plain language. Globus Commerce Ltd. strives to ensure that individuals are aware of the personal data being processed and that they fully understand and are informed regarding the processing in compliance with GDPR and Bulgarian legislation.
Globus Commerce Ltd. provides this information in writing or by other means, including electronically, where appropriate. If the individual requests this, the information can be provided orally, provided the individual’s identity is verified through other means.
Globus Commerce Ltd. provides individuals with free information regarding actions taken in response to a request regarding their rights of access, rectification, erasure, restriction of processing, data portability, objection, and automated decision-making, without undue delay and in all cases within one month of receiving the request. If necessary, this period can be extended by two more months, considering the complexity and number of requests. Globus Commerce Ltd. will inform the individual of any such extension within one month of receiving the request and explain the reasons for the delay. When an individual submits a request electronically, information will be provided electronically, unless otherwise requested by the individual.
If Globus Commerce Ltd. does not take action on the request, it will notify the individual without delay and no later than one month after receiving the request, explaining the reasons for not taking action and the possibility to lodge a complaint with a supervisory authority and seek judicial remedy.
If the requests from the individual are manifestly unfounded or excessive, particularly because of their repetitive nature, Globus Commerce Ltd. may impose a reasonable fee based on the administrative costs of providing the information or communication or taking the requested actions, or may refuse to act on the request.
Right of access of individuals
Every individual has the right to obtain from Globus Commerce Ltd. confirmation as to whether personal data concerning them are being processed, and, if so, to gain access to the data and the following information:
- the purposes of processing;
- the relevant categories of personal data;
- the recipients or categories of recipients to whom the personal data have been or will be disclosed (including in third countries or international organizations);
- where possible, the envisaged period for which the data will be stored, or, if not possible, the criteria used to determine that period;
- the existence of the right to request from Globus Commerce Ltd. rectification or erasure of personal data, or restriction of processing of personal data relating to the data subject, or to object to such processing;
- the right to lodge a complaint with the Commission for Personal Data Protection;
- where the personal data are not collected from the individual, any available information about their source;
- the existence of automated decision-making, including profiling, and, at least in those cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the individual.
Globus Commerce Ltd. provides the individual with a copy of the personal data undergoing processing. For any additional copies requested, the Controller may charge a reasonable fee based on administrative costs. Where the request is made by electronic means, the information shall be provided in a commonly used electronic form, unless otherwise requested by the individual.
Every individual whose data are processed by Globus Commerce Ltd. has the right to request Globus Commerce Ltd. to rectify inaccurate personal data concerning them without undue delay. Taking into account the purposes of the processing, the individual has the right to have incomplete personal data completed.
Every individual whose data are processed by Globus Commerce Ltd. has the right to request the erasure of personal data concerning them without undue delay, and Globus Commerce Ltd. has the obligation to erase personal data without undue delay where:
- the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
- the individual withdraws consent on which the processing is based, and there is no other legal ground for the processing;
- the individual objects to the processing and there are no overriding legitimate grounds for the processing;
- the personal data have been unlawfully processed;
- the personal data must be erased for compliance with a legal obligation applicable to Globus Commerce Ltd.;
- the personal data have been collected in relation to the offering of information society services.
Every individual whose data are processed by Globus Commerce Ltd. has the right to request restriction of processing where one of the following applies:
- the accuracy of the personal data is contested by the individual, for a period enabling Globus Commerce Ltd. to verify the accuracy of the personal data;
- the processing is unlawful, but the individual opposes erasure of the personal data and requests restriction of their use instead;
- Globus Commerce Ltd. no longer needs the personal data for the purposes of the processing, but the individual requires them for the establishment, exercise, or defense of legal claims;
- the individual has objected to processing, pending verification of whether the legitimate grounds of Globus Commerce Ltd. override those of the individual.
Where processing has been restricted, Globus Commerce Ltd. shall inform the individual before the restriction is lifted.
Globus Commerce Ltd. shall communicate any rectification, erasure, or restriction of processing to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. Globus Commerce Ltd. shall inform the individual about those recipients upon request.
The individual has the right to receive the personal data concerning them, which they have provided to Globus Commerce Ltd., in a structured, commonly used, and machine-readable format, and the right to transmit those data to another controller without hindrance from Globus Commerce Ltd., where:
- the processing is based on consent for specific purposes, or on a contractual obligation of the individual, or steps taken prior to entering into a contract; and
- the processing is carried out by automated means.
The individual has the right, at any time and on grounds relating to their particular situation, to object to processing of personal data concerning them (where the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in Globus Commerce Ltd., or for the purposes of legitimate interests pursued by Globus Commerce Ltd. or a third party), including profiling. Globus Commerce Ltd. shall no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the individual, or for the establishment, exercise, or defense of legal claims.
Where personal data are processed for direct marketing purposes, the individual shall have the right to object at any time to processing of personal data concerning them for such marketing, including profiling insofar as it relates to direct marketing. Where the individual objects to processing for direct marketing, the personal data shall no longer be processed for such purposes.
At the latest at the time of the first communication with the individual, they shall be explicitly informed of the existence of this right, which shall be presented clearly and separately from any other information.
The protection of data on paper as well as on electronic media against unlawful access, damage, loss, or destruction is ensured through a series of internally regulated technical and organizational measures.
The Controller does not and will not transfer personal data to countries outside the European Union.
Breaches
A data breach occurs when personal data for which Globus Commerce Ltd. is responsible are affected by a security incident resulting in a breach of confidentiality, availability, or integrity of personal data. A breach occurs when there is a security incident leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data transmitted, stored, or otherwise processed.
Assessment of breaches
Once an employee of Globus Commerce Ltd. becomes aware of a breach, they must determine whether the specific event constitutes a personal data breach and notify the manager of Globus Commerce Ltd. (if they are not already aware).
In the case of a personal data breach likely to result in a risk to the rights and freedoms of natural persons, Globus Commerce Ltd. (through the relevant employee), without undue delay and, where feasible, not later than 72 hours after becoming aware of it, shall notify the Commission for Personal Data Protection.
Where it is not possible to provide all information at the same time, it may be provided in phases without undue delay.
Where the breach is likely to result in a high risk to the rights and freedoms of natural persons, Globus Commerce Ltd. shall communicate the breach to the individual without undue delay.
Globus Commerce Ltd. documents every personal data breach, including the facts relating to the breach, its effects, and the remedial actions taken.
Accounting and commercial information, as well as all other data and documents relevant for taxation and mandatory social security contributions, are retained by Globus Commerce Ltd. for the following periods:
- payroll records – 50 years;
- accounting registers and financial statements – 10 years;
- tax and social security control documents – 5 years after the expiry of the limitation period for the public obligation concerned;
- all other carriers – 5 years.
After the retention period expires, information carriers (paper or electronic) that are not subject to submission to the National Archival Fund may be destroyed.
After the end of the retention period, data shall be destroyed as soon as possible – paper carriers by shredding, and electronic carriers by deletion and erasure of the relevant files from Globus Commerce Ltd.’s computers.